RubySec

Providing security resources for the Ruby community

CVE-2013-6461 (nokogiri): Nokogiri Gem for Ruby External Entity (XXE) Expansion Remote DoS

ADVISORIES

GEM

nokogiri

PATCHED VERSIONS

  • ~> 1.5.11
  • >= 1.6.1

DESCRIPTION

Nokogiri gem for Ruby contains an flaw that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can cause an infinite loop and crash the program.