CVE-2013-1821 Ruby vulnerable to denial of service

Medium 5.0 Published 9 Apr 2013 Updated 6 Aug 2024

Remote attackers can cause denial of service via memory exhaustion in the Ruby REXML parser using crafted XML entity expansion.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-1821?

CVE-2013-1821 is a medium-severity denial of service vulnerability in Ruby-Lang Ruby, published on 9 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.

Weakness: CWE-20

Which versions are affected by CVE-2013-1821?

2 open source packages ship an affected version, including org.jruby:jruby. It affects 1 product.

Package	Affected	Fixed in
`org.jruby:jruby` Maven	All versions	`1.7.3`
`org.jruby:jruby` Maven	All versions	`1.7.3`

Linux distribution packages (10)

`ruby` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-docs` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-irb` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-libs` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-mode` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-rdoc` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-ri` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`
`ruby-tcltk` Red Hat:enterprise_linux:5::server	All versions	`0:1.8.5-29.el5_9`

Products include Ruby-Lang Ruby.

How do I fix CVE-2013-1821?

Upgrade org.jruby:jruby to 1.7.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-1821 being exploited?

There is no known exploitation of CVE-2013-1821 in the wild and no public exploit code.

All Ruby-Lang Ruby vulnerabilities

Sources

Also known as GHSA-hgg7-cghq-xhf4, RHSA-2013:0611.