SB2015072708 - XML injection in Ruby on Rails
Published: July 27, 2015 Updated: September 29, 2025
Security Bulletin ID
SB2015072708
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) XML injection (CVE-ID: CVE-2015-3227)
The vulnerability allows a remote attacker to cause a denial of service (SystemStackError).
The vulnerability exists due to improper input validation when processing XML data in (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails. A remote unauthenticated attacker can pass specially crafted XML data to the application and cause a denial of service (SystemStackError).
Remediation
Install update from vendor's website.
References
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
- http://openwall.com/lists/oss-security/2015/06/16/16
- http://www.debian.org/security/2016/dsa-3464
- http://www.securityfocus.com/bid/75234
- http://www.securitytracker.com/id/1033755
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J