CVE-2013-6460: Medium severity Nokogiri Nokogiri vulnerability
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2013-6460?
CVE-2013-6460 is a vulnerability in the Nokogiri gem 1.5.x that allows for a Denial of Service attack through an infinite loop when parsing XML documents.
What software is affected by CVE-2013-6460?
The Nokogiri gem versions 1.5.x to 1.5.11 and 1.6.0 to 1.6.1 are affected. Also, certain versions of Debian Linux, Redhat Cloudforms Management Engine, Redhat Openstack, Redhat Satellite, and Redhat Enterprise MRG are affected.
How severe is CVE-2013-6460?
CVE-2013-6460 has a severity score of 6.5, which is considered medium.
How can I fix CVE-2013-6460?
To fix CVE-2013-6460, update the Nokogiri gem to version 1.10.0+dfsg1-2 or higher if using Debian, or update to versions 1.10.0+dfsg1-2+deb10u1, 1.11.1+dfsg-2, 1.13.10+dfsg-2, or 1.15.4+dfsg-1. For affected Redhat products, follow the remediation steps provided by Redhat.
Where can I find more information about CVE-2013-6460?
More information about CVE-2013-6460 can be found in the references: http://www.openwall.com/lists/oss-security/2013/12/27/2, http://www.securityfocus.com/bid/64513, https://access.redhat.com/security/cve/cve-2013-6460