From: Shugo Maeda <shugo.maeda@...>
Date: 2008-08-29T18:51:21+09:00
Subject: Re: DoS vulnerability in REXML

Hello,

Shugo Maeda <shugo.ma...@gmail.com> wrote:
> What do you think of fixing it like this?
>
> ---
> There is a DoS vulnerability in theREXMLlibrary included in the Ruby
> Standard Library. A so-called "XML entity explosion" attack technique
> can be used for remotely bringing down (disabling) any application
> which parses user-provided XML usingREXML.
>
> Most Rails applications will be vulnerable because Rails parses
> user-provided XML usingREXMLby default.
> ---

I have fixed the announcement.

  http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/

Thank you.

Shugo