### Impact
Specially crafted XML documents can cause applications to raise a
`SystemStackError` and potentially cause a denial of service attack. This
only impacts applications using REXML or JDOM as their XML processor. Other
XML processors that Rails supports are not impacted.
All users running an affected release should either upgrade or use one of the work arounds immediately.
### Releases
The FIXED releases are available at the normal locations.
### Workarounds
Use an XML parser that is not impacted by this problem, such as Nokogiri or
LibXML. You can change the processor like this:
```
ActiveSupport::XmlMini.backend = 'Nokogiri'
```
If you cannot change XML parsers, then adjust
`RUBY_THREAD_MACHINE_STACK_SIZE`.
### Credits
Thanks to Tomek Rabczak from the NCC Group, and Matthew Draper for reporting
this issue.
### 参考
* https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk
暂无评论