CVE-2008-3790: Input Validation
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3790?
CVE-2008-3790 is classified as a denial of service vulnerability due to its potential for causing high CPU usage.
How do I fix CVE-2008-3790?
To fix CVE-2008-3790, you should upgrade to a later version of Ruby that is not affected by this vulnerability.
Which versions of Ruby are affected by CVE-2008-3790?
CVE-2008-3790 affects Ruby versions 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9.
What types of attacks are possible with CVE-2008-3790?
CVE-2008-3790 allows for context-dependent attacks that may lead to denial of service via an XML entity explosion.
Can CVE-2008-3790 be exploited remotely?
Yes, CVE-2008-3790 can be exploited by attackers remotely through the submission of specially crafted XML documents.