| Package | Affected versions | Patched versions |
|---|---|---|
| org.jruby:jruby | < 1.7.3 | 1.7.3 |
| ruby | = 1.9= 1.9.1= 1.9.2= 1.9.3= 2.0= 2.0.0≤ 1.9.3 |
When reading text nodes from an XML document, the REXML parser can be coerced in to allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.
Jruby resolves this bug in version 1.7.3 as noted in https://www.jruby.org/2013/02/21/jruby-1-7-3.html
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free