PT-2013-3407 · Ruby+4 · Rexml+5

Published 2013-03-07 · Updated 2022-05-17 · CVE-2013-1821

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions REXML parser in Ruby versions prior to 1.9.3-p392

Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption and crash, via crafted text nodes in an XML document. This is also known as an XML Entity Expansion (XEE) attack. When reading text nodes from an XML document, the REXML parser can be coerced into allocating extremely large string objects, consuming all of the memory on a machine.

Recommendations For versions prior to 1.9.3-p392, update to version 1.9.3-p392 or later to resolve the issue. As a temporary workaround, consider restricting the use of the REXML parser until a patch is available.

Fix

DoS

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

ALT-PU-2016-2061

CESA-2013_0612

CVE-2013-1821

DSA-2738-1

DSA-2809-1

GHSA-HGG7-CGHQ-XHF4

RHSA-2013:0611

RHSA-2013:0612

RHSA-2013_0611

RHSA-2013_0612

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

SUSE-SU-2014_0689-1

SUSE-SU-2014_0843-1

Affected Products

Alt Linux

Centos

Rexml

Red Hat

Ruby

Suse

References · 28

• http://mandriva.com/security/advisories?name=MDVSA-2013:124 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1147.html · Vendor Advisory
• http://secunia.com/advisories/52902 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html · Vendor Advisory
• http://debian.org/security/2013/dsa-2809 · Vendor Advisory
• http://ubuntu.com/usn/USN-1780-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0612.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1821 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0611.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1028.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hgg7-cghq-xhf4 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862 · Vendor Advisory
• http://secunia.com/advisories/52783 · Vendor Advisory