CVE-2013-1821
Published Apr 9, 2013
Last updated 8 years ago
Overview
- Description
- lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
- nvd@nist.gov
- CWE-20
Evaluator
- Comment
- -
- Impact
- Per: http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ "Affected versions All ruby 1.9 versions prior to ruby 1.9.3 patchlevel 392 All ruby 2.0 versions prior to ruby 2.0.0 patchlevel 0 prior to trunk revision 39384"
- Solution
- Per: http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ "Affected versions All ruby 1.9 versions prior to ruby 1.9.3 patchlevel 392 All ruby 2.0 versions prior to ruby 2.0.0 patchlevel 0 prior to trunk revision 39384"
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:p385:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA8C0F8E-4C21-4181-84A5-D17E70D19D9A",
"versionEndIncluding": "1.9.3"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9237145-35F8-4E05-B730-77C0F386E5B2"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C78BB1D8-0505-484D-B824-1AA219F8B247"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5178D04D-1C29-4353-8987-559AA07443EC"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0535DC9-EB0E-4745-80AC-4A020DF26E38"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94F5AA37-B466-4E2E-B217-5119BADDD87B"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6DF0F0F5-4022-4837-9B40-4B1127732CC9"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3848B08-85C2-4AAD-AA33-CCEB80EF5B32"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7927D40-2A3A-43AD-99F6-CE61882A1FF4"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA406EC6-6CA5-40A6-A879-AA8940CBEF07"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90E0471D-1323-4E67-B66C-DEBF3BBAEEAA"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B03B7561-A854-4EFA-9E4E-CFC4EEAE4EE1"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "285A3431-BDFE-40C5-92CD-B18217757C23"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D66B32CB-AC49-4A1C-85ED-6389F27CB319"
}
],
"operator": "OR"
}
]
}
]