CVE-2013-1821: Input Validation
First published: Fri Feb 22 2013(Updated: )
An unrestricted entity expansion flaw was reported in Ruby that can lead to a denial of service in REXML. When reading text nodes from an XML document, the REXML parser could be coerced into allocating extremely large string objects which could consume all available memory on the system. Impacted code would look similar to the following: document = REXML::Document.new some_xml_doc document.root.text In this case, when the 'text' method is called, entities will be expanded. An attacker could send a relatively small XML document that, when the entities were resolved, would consume extremely large amounts of memory on the target system. It is noted that this vulnerability is similar to the 'Billion Laughs' attack, and is also related to <a href="https://access.redhat.com/security/cve/CVE-2013-1664">CVE-2013-1664</a> (Python). The upstream advisory has a work-around patch that limits the size of entity substitutions. External References: <a href="http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/">http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jruby:jruby | <1.7.3 | 1.7.3 |
| redhat/ruby | <1.9.3 | 1.9.3 |
| redhat/ruby | <2.0.0 | 2.0.0 |
| Ruby | <=1.9.3 | |
| Ruby | =1.9 | |
| Ruby | =1.9.1 | |
| Ruby | =1.9.2 | |
| Ruby | =1.9.3 | |
| Ruby | =1.9.3-p0 | |
| Ruby | =1.9.3-p125 | |
| Ruby | =1.9.3-p194 | |
| Ruby | =1.9.3-p286 | |
| Ruby | =1.9.3-p383 | |
| Ruby | =2.0 | |
| Ruby | =2.0.0 | |
| Ruby | =2.0.0-rc1 | |
| Ruby | =2.0.0-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2013-1821
- https://bugzilla.redhat.com/show_bug.cgi?id=914716
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0092
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00036.html
- http://rhn.redhat.com/errata/RHSA-2013-1147.html
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384
- http://www.debian.org/security/2013/dsa-2738
- http://www.debian.org/security/2013/dsa-2809
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:124
- http://www.openwall.com/lists/oss-security/2013/03/06/5
- http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862
- http://www.ubuntu.com/usn/USN-1780-1
- https://www.jruby.org/2013/02/21/jruby-1-7-3.html
- https://github.com/advisories/GHSA-hgg7-cghq-xhf4 (Advisory)
- https://access.redhat.com/security/cve/CVE-2013-1664
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=914726
- https://access.redhat.com/security/cve/CVE-2013-1821
- https://rhn.redhat.com/errata/RHSA-2013-0612.html
- https://rhn.redhat.com/errata/RHSA-2013-0611.html
- https://rhn.redhat.com/errata/RHSA-2013-1028.html
- https://rhn.redhat.com/errata/RHSA-2013-1147.html
- https://rhn.redhat.com/errata/RHSA-2013-1185.html
- http://rhn.redhat.com/errata/RHSA-2013-0611.html
- http://rhn.redhat.com/errata/RHSA-2013-0612.html
- http://rhn.redhat.com/errata/RHSA-2013-1028.html
- http://secunia.com/advisories/52783
- http://secunia.com/advisories/52902
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.securityfocus.com/bid/58141
Frequently Asked Questions
What is the severity of CVE-2013-1821?
CVE-2013-1821 is classified as a medium-severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2013-1821?
To fix CVE-2013-1821, upgrade Ruby to version 1.9.3 or later, or JRuby to 1.7.3 or later.
What are the impacts of CVE-2013-1821?
The impacts of CVE-2013-1821 include the possibility of exhausting system memory due to unrestricted entity expansion in XML parsing.
Which Ruby versions are affected by CVE-2013-1821?
Ruby versions prior to 1.9.3, including all 1.9.x versions, are affected by CVE-2013-1821.
Is JRuby affected by CVE-2013-1821?
Yes, JRuby versions prior to 1.7.3 are affected by CVE-2013-1821.
- collector/github-advisory-latest
- alias/GHSA-hgg7-cghq-xhf4
- alias/CVE-2013-1821
- collector/github-advisory
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/maven
- package-manager/redhat
- vendor/ruby-lang
- canonical/ruby
- version/ruby/1.9.3
- version/ruby/1.9
- version/ruby/1.9.1
- version/ruby/1.9.2
- version/ruby/1.9.3-p0
- version/ruby/1.9.3-p125
- version/ruby/1.9.3-p194
- version/ruby/1.9.3-p286
- version/ruby/1.9.3-p383
- version/ruby/2.0
- version/ruby/2.0.0
- version/ruby/2.0.0-rc1
- version/ruby/2.0.0-rc2