cvelistv5 - CVE-2013-6460

CVE-2013-6460

Vulnerability from cvelistv5

Published

2019-11-05 14:02

Modified

2024-08-06 17:39

Severity ?

Summary

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

References

URL	Tags
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2013/12/27/2	Mailing List, Third Party Advisory
secalert@redhat.com	http://www.securityfocus.com/bid/64513	Third Party Advisory, VDB Entry
secalert@redhat.com	https://access.redhat.com/security/cve/cve-2013-6460	Third Party Advisory
secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460	Exploit, Issue Tracking, Patch, Third Party Advisory
secalert@redhat.com	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460	Issue Tracking, Third Party Advisory
secalert@redhat.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/90058	Third Party Advisory, VDB Entry
secalert@redhat.com	https://security-tracker.debian.org/tracker/CVE-2013-6460	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2013/12/27/2	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/64513	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/security/cve/cve-2013-6460	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460	Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/90058	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://security-tracker.debian.org/tracker/CVE-2013-6460	Third Party Advisory

Impacted products

Vendor

Product

Version

▼

Ruby

Nokogiri gem

Version: 1.5.x
Version: 1.6.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T17:39:01.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2013-6460"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/64513"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Nokogiri gem",
          "vendor": "Ruby",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.x"
            },
            {
              "status": "affected",
              "version": "1.6.x"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "while parsing XML documents",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-05T14:02:54",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2013-6460"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/64513"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-6460",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Nokogiri gem",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.5.x"
                          },
                          {
                            "version_value": "1.6.x"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Ruby"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "while parsing XML documents"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2013-6460",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460",
              "refsource": "MISC",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2013-6460",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2013-6460"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2013/12/27/2",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
            },
            {
              "name": "http://www.securityfocus.com/bid/64513",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/64513"
            },
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058",
              "refsource": "MISC",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-6460",
    "datePublished": "2019-11-05T14:02:54",
    "dateReserved": "2013-11-04T00:00:00",
    "dateUpdated": "2024-08-06T17:39:01.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.5.0\", \"versionEndExcluding\": \"1.5.11\", \"matchCriteriaId\": \"8C40BEDA-6032-4759-BAC4-F370195EBF92\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.6.0\", \"versionEndExcluding\": \"1.6.1\", \"matchCriteriaId\": \"8E232347-7EC2-4F3C-820B-170F6120AE16\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7098B44F-56BF-42E3-8831-48D0A8E99EE2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6533B15B-F748-4A5D-AB86-31D38DFAE60F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1802FDB8-C919-4D5E-A8AD-4C5B72525090\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"848C92A9-0677-442B-8D52-A448F2019903\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B0E2C740-099C-427F-846D-951A2A1BF07E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C60FA8B1-1802-4522-A088-22171DCF7A93\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents\"}, {\"lang\": \"es\", \"value\": \"La gema Nokogiri versiones 1.5.x, tiene una Denegaci\\u00f3n de Servicio por medio de un bucle infinito cuando se analizan documentos XML.\"}]",
      "id": "CVE-2013-6460",
      "lastModified": "2024-11-21T01:59:16.567",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2019-11-05T15:15:11.483",
      "references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2013/12/27/2\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/64513\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://access.redhat.com/security/cve/cve-2013-6460\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/90058\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2013-6460\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2013/12/27/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/64513\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://access.redhat.com/security/cve/cve-2013-6460\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/90058\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2013-6460\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-776\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2013-6460\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2019-11-05T15:15:11.483\",\"lastModified\":\"2024-11-21T01:59:16.567\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents\"},{\"lang\":\"es\",\"value\":\"La gema Nokogiri versiones 1.5.x, tiene una Denegaci\u00f3n de Servicio por medio de un bucle infinito cuando se analizan documentos XML.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-776\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.5.0\",\"versionEndExcluding\":\"1.5.11\",\"matchCriteriaId\":\"8C40BEDA-6032-4759-BAC4-F370195EBF92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.6.0\",\"versionEndExcluding\":\"1.6.1\",\"matchCriteriaId\":\"8E232347-7EC2-4F3C-820B-170F6120AE16\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7098B44F-56BF-42E3-8831-48D0A8E99EE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6533B15B-F748-4A5D-AB86-31D38DFAE60F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1802FDB8-C919-4D5E-A8AD-4C5B72525090\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"848C92A9-0677-442B-8D52-A448F2019903\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E2C740-099C-427F-846D-951A2A1BF07E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C60FA8B1-1802-4522-A088-22171DCF7A93\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2013/12/27/2\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/64513\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/security/cve/cve-2013-6460\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/90058\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://security-tracker.debian.org/tracker/CVE-2013-6460\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/12/27/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/64513\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/security/cve/cve-2013-6460\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/90058\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://security-tracker.debian.org/tracker/CVE-2013-6460\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}

ghsa-62qp-3fxm-9wxf

Vulnerability from github

Published

2022-05-05 00:29

Modified

2023-06-09 19:45

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Nokogiri vulnerable to DoS while parsing XML documents

Details

Nokogiri gem has Denial of Service via infinite loop when parsing XML documents

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "nokogiri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "nokogiri"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-6460"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-09T19:45:51Z",
    "nvd_published_at": "2019-11-05T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Nokogiri gem has Denial of Service via infinite loop when parsing XML documents",
  "id": "GHSA-62qp-3fxm-9wxf",
  "modified": "2023-06-09T19:45:51Z",
  "published": "2022-05-05T00:29:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/cve-2013-6460"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sparklemotion/nokogiri"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nokogiri vulnerable to DoS while parsing XML documents"
}

gsd-2013-6460

Vulnerability from gsd

Modified

2013-12-14 00:00

Details

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

Aliases

CVE-2013-6460

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2013-6460",
    "description": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents",
    "id": "GSD-2013-6460",
    "references": [
      "https://www.suse.com/security/cve/CVE-2013-6460.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "nokogiri",
            "purl": "pkg:gem/nokogiri"
          }
        }
      ],
      "aliases": [
        "CVE-2013-6460",
        "OSVDB-101179"
      ],
      "details": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents",
      "id": "GSD-2013-6460",
      "modified": "2013-12-14T00:00:00.000Z",
      "published": "2013-12-14T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 4.3,
          "type": "CVSS_V2"
        }
      ],
      "summary": "CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2013-6460",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Nokogiri gem",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "1.5.x"
                        },
                        {
                          "version_value": "1.6.x"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Ruby"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "while parsing XML documents"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://security-tracker.debian.org/tracker/CVE-2013-6460",
            "refsource": "MISC",
            "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460",
            "refsource": "MISC",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
          },
          {
            "name": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460",
            "refsource": "MISC",
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
          },
          {
            "name": "https://access.redhat.com/security/cve/cve-2013-6460",
            "refsource": "MISC",
            "url": "https://access.redhat.com/security/cve/cve-2013-6460"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2013/12/27/2",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
          },
          {
            "name": "http://www.securityfocus.com/bid/64513",
            "refsource": "MISC",
            "url": "http://www.securityfocus.com/bid/64513"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2013-6460",
      "cvss_v2": 4.3,
      "date": "2013-12-14",
      "description": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents",
      "gem": "nokogiri",
      "osvdb": 101179,
      "patched_versions": [
        "~\u003e 1.5.11",
        "\u003e= 1.6.1"
      ],
      "platform": "jruby",
      "title": "CVE-2013-6460 rubygem-nokogiri: DoS while parsing XML documents",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.5 \u003c1.5.11 || \u003e=1.6 \u003c1.6.1",
          "affected_versions": "All versions starting from 1.5.x before 1.5.11, all versions starting from 1.6.x before 1.6.1",
          "credit": "Yoko Harada and John Shahid.",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-776",
            "CWE-937"
          ],
          "date": "2019-11-08",
          "description": "Attackers can send XML documents with carefully crafted documents which can cause the XML processor to enter an infinite loop, causing the server to run out of memory and crash. Impacted code will look something like this: `doc = Nokogiri.XML(untrusted_input)`.",
          "fixed_versions": [
            "1.5.11",
            "1.6.1"
          ],
          "identifier": "CVE-2013-6460",
          "identifiers": [
            "CVE-2013-6460"
          ],
          "not_impacted": "You\u0027re not impacted if you are not using JRuby or if you don\u0027t send untrusted input to Nokogiri XML parser.",
          "package_slug": "gem/nokogiri",
          "pubdate": "2019-11-05",
          "solution": "Upgrade to latest fixed version or see workaround in source link.",
          "title": "Memory Exhaustion Vulnerability when using JRuby",
          "urls": [
            "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA"
          ],
          "uuid": "48c19f1a-1c74-4c40-aae3-826fda7cea6e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.6.1",
                "versionStartIncluding": "1.6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.5.11",
                "versionStartIncluding": "1.5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-6460"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-776"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
            },
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2013-6460",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/security/cve/cve-2013-6460"
            },
            {
              "name": "http://www.securityfocus.com/bid/64513",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/64513"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2013/12/27/2",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2013-6460",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-07-15T19:16Z",
      "publishedDate": "2019-11-05T15:15Z"
    }
  }
}

CVE-2013-6460

Vulnerability from fkie_nvd

Published

2019-11-05 15:15

Modified

2024-11-21 01:59

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

References

URL	Tags
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2013/12/27/2	Mailing List, Third Party Advisory
secalert@redhat.com	http://www.securityfocus.com/bid/64513	Third Party Advisory, VDB Entry
secalert@redhat.com	https://access.redhat.com/security/cve/cve-2013-6460	Third Party Advisory
secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460	Exploit, Issue Tracking, Patch, Third Party Advisory
secalert@redhat.com	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460	Issue Tracking, Third Party Advisory
secalert@redhat.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/90058	Third Party Advisory, VDB Entry
secalert@redhat.com	https://security-tracker.debian.org/tracker/CVE-2013-6460	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2013/12/27/2	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/64513	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/security/cve/cve-2013-6460	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460	Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/90058	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://security-tracker.debian.org/tracker/CVE-2013-6460	Third Party Advisory

Impacted products

Vendor	Product	Version
nokogiri	nokogiri	*
nokogiri	nokogiri	*
debian	debian_linux	8.0
debian	debian_linux	9.0
debian	debian_linux	10.0
redhat	cloudforms_management_engine	5.0
redhat	openstack	3.0
redhat	openstack	4.0
redhat	satellite	6.0
redhat	subscription_asset_manager	-
redhat	enterprise_mrg	2.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C40BEDA-6032-4759-BAC4-F370195EBF92",
              "versionEndExcluding": "1.5.11",
              "versionStartIncluding": "1.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E232347-7EC2-4F3C-820B-170F6120AE16",
              "versionEndExcluding": "1.6.1",
              "versionStartIncluding": "1.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7098B44F-56BF-42E3-8831-48D0A8E99EE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6533B15B-F748-4A5D-AB86-31D38DFAE60F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1802FDB8-C919-4D5E-A8AD-4C5B72525090",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "848C92A9-0677-442B-8D52-A448F2019903",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:subscription_asset_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0E2C740-099C-427F-846D-951A2A1BF07E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C60FA8B1-1802-4522-A088-22171DCF7A93",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents"
    },
    {
      "lang": "es",
      "value": "La gema Nokogiri versiones 1.5.x, tiene una Denegaci\u00f3n de Servicio por medio de un bucle infinito cuando se analizan documentos XML."
    }
  ],
  "id": "CVE-2013-6460",
  "lastModified": "2024-11-21T01:59:16.567",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-11-05T15:15:11.483",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/64513"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/cve-2013-6460"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/64513"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/cve-2013-6460"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-776"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2013-6460

Vulnerability from cvelistv5

ghsa-62qp-3fxm-9wxf

Vulnerability from github

gsd-2013-6460

Vulnerability from gsd

CVE-2013-6460

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature