CVE-2013-6460

CWE-776 — XML Entity Expansion (Billion Laughs)7 documents7 sources
Severity
6.5MEDIUM
EPSS
2.5%
top 14.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Nokogiri NokogiriRuby Nokogiri GEMDebian Debian Linux+4 more
Timeline
PublishedNov 5
Latest updateMay 5

Description

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages7 packages

▶RubyGemsnokogiri1.5.0 — 1.5.11+1
▶NVDnokogiri/nokogiri1.5.0 — 1.5.11+1
▶CVEListV5ruby/nokogiri_gem1.5.x, 1.6.x+1
▶NVDredhat/openstack3.0, 4.0+1

Also affects: Debian Linux 10.0, 8.0, 9.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
OSV
Nokogiri vulnerable to DoS while parsing XML documents↗2022-05-05
▶
GHSA
Nokogiri vulnerable to DoS while parsing XML documents↗2022-05-05
▶
CVEList
CVE-2013-6460: Nokogiri gem 1↗2019-11-05
▶

📋Vendor Advisories

2
Red Hat
rubygem-nokogiri: DoS while parsing XML documents↗2013-12-15
▶
Debian
CVE-2013-6460: ruby-nokogiri - Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML docu...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents↗2013-12-26
▶