~ / search / GHSA-hgg7-cghq-xhf4

GHSA-hgg7-cghq-xhf4

Ruby vulnerable to denial of service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-1821

Packages

EcosystemPackageAffectedFixed in
Maven org.jruby:jruby < 1.7.3 1.7.3

Details

As written in the advisory (Markdown source, shown as plain text).

When reading text nodes from an XML document, the REXML parser can be coerced in to allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service. Jruby resolves this bug in version 1.7.3 as noted in https://www.jruby.org/2013/02/21/jruby-1-7-3.html

References

External links from the advisory. They lead to third-party sites.