CVE-2008-3790: ruby-lang ruby Improper Input Validation

CVSS: 5.0v2.0MediumModified

Published 27-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3790 is a medium (CVSS 5.0) Improper Input Validation vulnerability in ruby-lang ruby. EPSS estimates a 15.20% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

15.20%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 3

DSA-1651-1 DSA-1652-1 RHSA-2008:0897

Timeline

27-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

15.20%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 15.20% on 19-09-2026

19-09-202619-10-2026

EPSS score

15.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (ruby-lang.org)
Maturity: unknown
exploit-databasedoslinuxVerified
Ruby 1.9 - REXML Remote Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Ruby-lang1 product

ruby1.8.6 | 1.8.6:p110 | 1.8.6:p111 | 1.8.6:p114 | 1.8.6:p230 | 1.8.6:p286 | 1.8.6:p287 | 1.8.6:p36 | 1.8.6:preview1 | 1.8.6:preview2 | 1.8.6:preview3 | 1.8.7 | 1.8.7:p17 | 1.8.7:p22 | 1.8.7:p71 | 1.8.7:p72 | 1.8.7:preview1 | 1.8.7:preview2 | 1.8.7:preview3 | 1.8.7:preview4 | 1.9

1 vendor · 1 product

References

35 links

usn.ubuntu.com/651-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/33185Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10393VDB EntrySignatureX Refsource OVAL
support.apple.com/kb/HT3549X Refsource CONFIRM
www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rbX Refsource CONFIRMPatch
www.securitytracker.com/id?1020735VDB EntryX Refsource SECTRACK
www.debian.org/security/2008/dsa-1652Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-October/msg00299.htmlVendor AdvisoryX Refsource FEDORA
www.vupen.com/english/advisories/2008/2428VDB EntryX Refsource VUPEN
exchange.xforce.ibmcloud.com/vulnerabilities/44628VDB EntryX Refsource XF

Show all 35 references

secunia.com/advisories/35074Third Party AdvisoryX Refsource SECUNIA
www.openwall.com/lists/oss-security/2008/08/26/4Mailing ListX Refsource MLIST
weblog.rubyonrails.org/2008/9/3/rails-2-0-4-maintenance-releaseX Refsource CONFIRM
support.avaya.com/elmodocs2/security/ASA-2008-424.htmX Refsource CONFIRM
www.debian.org/security/2008/dsa-1651Vendor AdvisoryX Refsource DEBIAN
lists.apple.com/archives/security-announce/2009/May/msg00002.htmlVendor AdvisoryX Refsource APPLE
www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/X Refsource CONFIRMExploitPatch
www.redhat.com/support/errata/RHSA-2008-0897.htmlVendor AdvisoryX Refsource REDHAT
groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352caX Refsource MISC
www.openwall.com/lists/oss-security/2008/08/25/4Mailing ListX Refsource MLIST
secunia.com/advisories/32219Third Party AdvisoryX Refsource SECUNIA
www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/32255Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/1297VDB EntryX Refsource VUPEN
www.securityfocus.com/bid/30802VDB EntryX Refsource BID
usn.ubuntu.com/691-1/Vendor AdvisoryX Refsource UBUNTU
www.openwall.com/lists/oss-security/2008/08/26/1Mailing ListX Refsource MLIST
secunia.com/advisories/32371Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32165Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200812-17.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/33178Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-October/msg00259.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/32256Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31602Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2483VDB EntryX Refsource VUPEN

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities