CVE-2013-1821
ruby-lang ruby: no CVSS score yet. EPSS 6.9% chance of exploitation in the next 30 days. Fixed in org.jruby:jruby 1.7.3.
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
- EPSS
- 6.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ruby-lang:ruby
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hgg7-cghq-xhf4 | Maven | org.jruby:jruby | <1.7.3 | 1.7.3 |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00036.html