Bug 1046664 (CVE-2013-6461)

Summary:	CVE-2013-6461 rubygem-nokogiri: DoS while parsing XML entities
Product:	[Other] Security Response	Reporter:	Ratul Gupta <ratulg>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, bdunne, bhu, bkearney, bleanhar, ccoleman, chrisw, cpelland, dajohnso, dallan, dmcphers, esammons, gkotton, iboverma, jdetiber, jfrey, jialiu, jomara, jrafanie, jross, katello-bugs, kseifried, lhh, lmeyer, markmc, matt, mcressma, mmccune, mrg-program-list, mtasaka, obarenbo, rbryant, rhos-maint, sclewis, tremble, vanmeeuwen+fedora, vondruch, williams, xlecauch, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rubygem-nokogiri 1.5.11, rubygem-nokogiri 1.6.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-01-23 19:23:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1046665
Bug Blocks:	1046667

Description Ratul Gupta 2013-12-26 13:14:53 UTC

Nokogiri gem for Ruby was found to be affected by a DoS vulnerability, where an error when parsing XML entities and can be exploited to exhaust memory and cause a crash via a specially crafted XML document including external entity references.

This issue is said to be affecting the versions 1.5.x and 1.6.x, 1.4.x and earlier versions are reported to be not affected by this vulnerability.

This issue is said to be fixed in versions 1.5.11 and 1.6.1.

References:
https://bugs.gentoo.org/show_bug.cgi?id=495218

Original Advisory:
https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA

Comment 1 Ratul Gupta 2013-12-26 13:19:17 UTC

Created rubygem-nokogiri tracking bugs for this issue:

Affects: fedora-all [bug 1046665]

Comment 2 Ratul Gupta 2013-12-27 05:18:36 UTC

CVE Request:
http://seclists.org/oss-sec/2013/q4/551

Comment 3 Mamoru TASAKA 2013-12-27 10:20:51 UTC

Setting needinfo also here. See bug 1046663 comment 2

Comment 5 Vincent Danen 2014-01-23 19:23:51 UTC

This issue does not affect anything we ship.  While the nokogiri rubygem is included in Fedora and EPEL, there is no JRuby implementation provided on either platform.