Bug 1046663 (CVE-2013-6460) - CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents
Summary: CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-6460
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1046665
Blocks: 1046667
TreeView+ depends on / blocked
 
Reported: 2013-12-26 13:14 UTC by Ratul Gupta
Modified: 2020-02-11 00:41 UTC (History)
43 users (show)

Fixed In Version: rubygem-nokogiri 1.5.11, rubygem-nokogiri 1.6.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-01-23 19:22:11 UTC


Attachments (Terms of Use)

Description Ratul Gupta 2013-12-26 13:14:44 UTC
Nokogiri gem for Ruby was found to be affected by a DoS vulnerability, where an error when parsing XML documents can be exploited by an attacker to cause an infinite loop and subsequently exhaust memory and cause a crash via a specially crafted XML document.

This issue is said to be affecting the versions 1.5.x and 1.6.x, 1.4.x and earlier versions are reported to be not affected by this vulnerability.

This issue is said to be fixed in versions 1.5.11 and 1.6.1.

References:
https://bugs.gentoo.org/show_bug.cgi?id=495218

Original Advisory:
https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA

Comment 1 Ratul Gupta 2013-12-26 13:18:48 UTC
Created rubygem-nokogiri tracking bugs for this issue:

Affects: fedora-all [bug 1046665]

Comment 2 Mamoru TASAKA 2013-12-26 14:43:03 UTC
Would you confirm if this really affects fedora? Upstream info says JRuby extension is affected, patches are for .java files, however fedora (at least fedora's rubygem-nokogiri srpm) does not ship nokogiri JRuby extension.
Java files are included in http://rubygems.org/downloads/nokogiri-1.5.11-java.gem or so, however fedora srpm does not use this, and uses http://rubygems.org/downloads/nokogiri-1.5.9.gem or so.

Comment 3 Ratul Gupta 2013-12-27 05:17:30 UTC
CVE Request:
http://seclists.org/oss-sec/2013/q4/551

Comment 4 Mamoru TASAKA 2013-12-27 10:20:03 UTC
Again setting needinfo.

Comment 6 Vincent Danen 2014-01-23 19:22:11 UTC
This issue does not affect anything we ship.  While the nokogiri rubygem is included in Fedora and EPEL, there is no JRuby implementation provided on either platform.


Note You need to log in before you can comment on or make changes to this bug.