CVE-2013-6460

Vulnerability

Description

CVE-2013-6460 is a denial of service vulnerability in the Nokogiri gem for Ruby, specifically in versions 1.5.x. The bug occurs during XML parsing, where a specially crafted XML document can trigger an error that causes an infinite loop, leading to excessive memory consumption and a crash. This issue was reported to Red Hat and assigned this CVE identifier [1][4].

Exploitation

An attacker can exploit this vulnerability by providing a malicious XML document to an application using the affected Nokogiri gem. The attack does not require authentication or complex prerequisites; simply parsing the crafted input is sufficient to trigger the infinite loop. The vulnerability is rooted in the parsing logic that fails to handle certain malformed XML constructs gracefully [1][3].

Impact

Successful exploitation results in a denial of service condition. The infinite loop exhausts system memory, potentially causing the Ruby process or the entire application to crash. This can disrupt the availability of services that rely on Nokogiri for XML processing [1][4].

Mitigation

Users of Nokogiri 1.5.x should upgrade to a patched version. The Nokogiri project has addressed this issue in later releases (e.g., 1.6.x and beyond). The NVD entry also lists references to the oss-security mailing list disclosure and Red Hat advisory [2][3]. No workaround other than upgrading is known.