CVE-2013-6461 : Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to ap

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

Published 2019-11-05 15:15:12

Updated 2021-07-15 19:16:10

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2013-6461

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Redhat » Subscription Asset Manager » Version: N/A
cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 4.0
cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 3.0
cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*
Matching versions
Redhat » Cloudforms Management Engine » Version: 5.0
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*
Matching versions
Redhat » Satellite » Version: 6.0
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Mrg » Version: 2.0
cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*
Matching versions
Nokogiri » Nokogiri
Versions from including (>=) 1.5.0 and before (<) 1.5.11
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Matching versions
Nokogiri » Nokogiri
Versions from including (>=) 1.6.0 and before (<) 1.6.1
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.35%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Assigned by: nvd@nist.gov (Primary)

http://www.openwall.com/lists/oss-security/2013/12/27/2

oss-security - Re: CVE Request: rubygem-nokogiri Multiple DoS vulnerabilities
Mailing List;Third Party Advisory

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/90059

Nokogiri gem for Ruby XML entities denial of service CVE-2013-6461 Vulnerability Report
Third Party Advisory;VDB Entry
https://access.redhat.com/security/cve/cve-2013-6461

Red Hat Customer Portal
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-6461

CVE-2013-6461
Third Party Advisory
http://www.securityfocus.com/bid/64513

Ruby Nokogiri Gem XML Parsing Multiple Denial of Service Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461

1046664 – (CVE-2013-6461) CVE-2013-6461 rubygem-nokogiri: DoS while parsing XML entities
Exploit;Issue Tracking;Third Party Advisory

Jump to