Homepage
About Snyk

XML External Entity (XXE) Injection Affecting nokogiri package, versions >=1.6, <1.6.1 <1.5.11

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.35% (72nd percentile)
Expand this section
NVD
6.5 medium
Expand this section
Red Hat
4.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-NOKOGIRI-20127
  • published 13 Dec 2013
  • disclosed 13 Dec 2013
  • credit Jonas Nicklas
Report a new vulnerability Found a mistake?

Introduced: 13 Dec 2013

CVE-2013-6461 Open this link in a new tab
CWE-400 Open this link in a new tab

How to fix?

Upgrade nokogiri to versions 1.5.11, 1.6.1 or higher.

Overview

nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.

Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks. It contains an flaw that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can cause an infinite loop and crash the program.