5 things an email marketing manager should know

- 41studio
- August 3, 2015
- Uncategorized

Email marketing is special, it has a lot of tools available, but at the same time is a very old technology.

CVE-2014-8080: Denial of Service XML Expansion

October 27, 2014

Unrestricted entity expansion can lead to a DoS vulnerability in REXML. This vulnerability has been assigned the CVE identifier CVE-2014-8080. We strongly recommend to upgrade Ruby.

Details

When reading text nodes from an XML document, the REXML parser can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.

Impacted code will look something like this:

require 'rexml/document'

xml = <<XML
<!DOCTYPE root [
  # ENTITY expansion vector
]>
<cd></cd>
XML

p REXML::Document.new(xml)

All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected versions

All Ruby 1.9 versions prior to Ruby 1.9.3 patchlevel 550
All Ruby 2.0 versions prior to Ruby 2.0.0 patchlevel 594
All Ruby 2.1 versions prior to Ruby 2.1.4
prior to trunk revision 48161

Workarounds

If you cannot upgrade Ruby, use this monkey patch as a workaround on versions of Ruby 2.1.0+:

class REXML::Entity
  def value
      if @value
        matches = @value.scan(PEREFERENCE_RE)
        rv = @value.clone
        if @parent
          sum = 0
          matches.each do |entity_reference|
            entity_value = @parent.entity( entity_reference[0] )
            if sum + entity_value.bytesize > Security.entity_expansion_text_limit
              raise "entity expansion has grown too large"
            else
              sum += entity_value.bytesize
            end
            rv.gsub!( /%#{entity_reference.join};/um, entity_value )
          end
        end
        return rv
      end
      nil
   end
end

For versions of Ruby older than 2.1.0, you can use the following monkey patch:

class REXML::Entity
  def value
      if @value
        matches = @value.scan(PEREFERENCE_RE)
        rv = @value.clone
        if @parent
          sum = 0
          matches.each do |entity_reference|
            entity_value = @parent.entity( entity_reference[0] )
            if sum + entity_value.bytesize > Document.entity_expansion_text_limit
              raise "entity expansion has grown too large"
            else
              sum += entity_value.bytesize
            end
            rv.gsub!( /%#{entity_reference.join};/um, entity_value )
          end
        end
        return rv
      end
      nil
   end
end

Credits

Thanks to Willis Vandevanter for reporting this issue.

History

Originally published at 2014-10-27 12:00:00 (UTC)

Posted by zzak on 27 Oct 2014

[…]

Ruby 2.2.0 Released

December 25, 2014

We are pleased to announce the release of Ruby 2.2.0.

Ruby 2.2 includes many new features and improvements for the increasingly diverse and expanding demands for Ruby.

For example, Ruby’s Garbage Collector is now able to collect Symbol type objects. This reduces memory usage of Symbols; because GC was previously unable to collect them before 2.2. Since Rails 5.0 will require Symbol GC, it will support only Ruby 2.2 or later. (See Rails 4.2 release post for details.)

Also, a reduced pause time thanks to the new Incremental Garbage Collector will be helpful for running Rails applications. Recent developments mentioned on the Rails blog suggest that Rails 5.0 will take advantage of Incremental GC as well as Symbol GC.

Another feature related to memory management is an additional option for configure.in to use jemalloc Feature #9113. This feature is still experimental and currently disabled by default until we gather performance data and more use cases. When we are convinced of the benefits, this feature will be enabled by default.

Experimental support for using vfork(2) with system() and spawn() have also been added. You can read more detail on tanaka-san’s blog in Japanese. This could potentially bring huge speed-up when a large process executes external commands many times. However vfork(2) is still not well understood and a potentially harmful system call. We would like to experiment to find out how much benefit can be gained by gathering performance data and use cases.

Try and enjoy programming with Ruby 2.2.0, and report us your findings!

Notable Changes since 2.1

Incremental GC (presentation at RubyConf 2014: “Incremental GC for Ruby interpreter”)
Symbol GC (presentation at RubyKaigi 2014)
configure –with-jemalloc Feature #9113
core libraries:
- Support Unicode 7.0 #9092
- New methods:
  - Enumerable#slice_after #9071, Enumerable#slice_when #9826
  - Float#next_float, Float#prev_float #9834
  - File.birthtime, File#birthtime #9647
  - String#unicode_normalize #10084
bundled libraries:
- Update Psych 2.0.8
- Update Rake 10.4.2
- Update RDoc 4.2.0
- Update RubyGems 2.4.5
- Update test-unit 3.0.8 (removed from repository but bundled in tarball)
- Update minitest 5.4.3 (removed from repository but bundled in tarball)
- Deprecate mathn
C API
- Remove deprecated APIs

See NEWS in Ruby repository for details.

With those changes, 1557 files changed, 125039 insertions(+), 74376 deletions(-) from v2.1.0!

Download

http://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.0.tar.bz2
- SIZE: 13304042 bytes
- MD5: d03cd4690fec1fff81d096d1c1255fde
- SHA256: 1c031137999f832f86be366a71155113675b72420830ce432b777a0ff4942955
- SHA512: 04edc53e8cd1732c3ca61ebeb1d6133614beb10f77f9abb80d8d36352fe8aa205112068e460bf600b2c7e81e0ddcc3b311e7e027c320366f1bd992b3e378a6ad
http://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.0.tar.gz
- SIZE: 16494584 bytes
- MD5: cd03b28fd0b555970f5c4fd481700852
- SHA256: 7671e394abfb5d262fbcd3b27a71bf78737c7e9347fa21c39e58b0bb9c4840fc
- SHA512: 1ba0c68e1c8d2b60bbd1e218cf36463edbe34cf9418d7593702b631e68d02297465f752e71395f6cfa4104f4cd70a1eb44381ffb74bc7801758b830931fdcfc6
http://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.0.tar.xz
- SIZE: 10304244 bytes
- MD5: 54b43c6c6c9dd4c4b08ceb03ad0ded7a
- SHA256: 848714e280fc5fb44dbac3b060b206e56c1947006324ee68a174d68b483ef8ca
- SHA512: cd7e52faa464df8aca7ccfa23a5f06248e1ad82bc8c9f1829aa1b51ff37b15973b8caaa68e914d837325b8d59427fda4f3cad82c50925e1c84e688324a2a155d
http://cache.ruby-lang.org/pub/ruby/2.2/ruby-2.2.0.zip
- SIZE: 18441027 bytes
- MD5: f8e1d0cee4f2d9535a9529ed23ae3700
- SHA256: e06c1e2b1248cf881749833084b2bec93f7612676009190ff9bc89b8fd07c29f
- SHA512: 364dd927b496520d95a1b06c68e1a265015f4cab08bdf3efaa323d385e7bf075eae47f2e1db78a629db0f3c0c1ed24e086603ba21e2da02ac06dd3c8b716766e

Posted by naruse on 25 Dec 2014

[…]

The Ruby Rails Aggregator