What is GHSA-jmhh-w7xp-wg39?

GHSA-jmhh-w7xp-wg39 is a security advisory published by GitHub Security Advisories with Medium severity. Nokogiri vulnerable to DoS while parsing XML entities

Which CVE IDs does GHSA-jmhh-w7xp-wg39 cover?

GHSA-jmhh-w7xp-wg39 covers the following CVE IDs: CVE-2013-6461. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jmhh-w7xp-wg39?

GHSA-jmhh-w7xp-wg39 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jmhh-w7xp-wg39?

GHSA-jmhh-w7xp-wg39 affects 2 products, including: rubygems/nokogiri:\u003e= 1.5.0, \u003c 1.5.11; rubygems/nokogiri:\u003e= 1.6.0, \u003c 1.6.1.

GHSA-jmhh-w7xp-wg39MediumCVSS 6.5

Nokogiri vulnerable to DoS while parsing XML entities

Vendor

GitHub Security Advisories

Published

May 5, 2022

Last Modified

June 30, 2023

🔗 CVE IDs covered (1)

CVE-2013-6461 →

📋 Description

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

🎯 Affected products2

rubygems/nokogiri:>= 1.5.0, < 1.5.11
rubygems/nokogiri:>= 1.6.0, < 1.6.1

🔗 References (9)

https://nvd.nist.gov/vuln/detail/CVE-2013-6461
https://access.redhat.com/security/cve/cve-2013-6461
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461
https://exchange.xforce.ibmcloud.com/vulnerabilities/90059
https://security-tracker.debian.org/tracker/CVE-2013-6461
http://www.openwall.com/lists/oss-security/2013/12/27/2
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml
https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513
https://github.com/advisories/GHSA-jmhh-w7xp-wg39