GitHub Advisoryadvisory · RubyGems

GHSA-q7wx-62r7-j2x7 Nokogiri vulnerable to libxml XML Entity Expansion

MEDIUM Published 2018-08-08 Modified 2023-03-14 Official page ↗
Aliases
CVE-2015-1819
Ecosystem
RubyGems
Packages
nokogiri
Severity
Moderate
Weaknesses
CWE-776
Reviewed
2020-06-16

Affected packages

• RubyGems nokogiri: >= 1.6.6.0, < 1.6.6.4 → fixed in 1.6.6.4

Description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

Related

Alias · CVE (1)

  • CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML… vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References