class Dawn::Kb::CVE_2013_6460

Public Class Methods

new() click to toggle source
Calls superclass method Dawn::Kb::ComboCheck::new
# File lib/dawn/kb/cve_2013_6460.rb, line 34
                      def initialize
message = "There is a vulnerability in Nokogiri when using JRuby where the parser can enter an infinite loop and exhaust the process memory. Nokogiri users on JRuby using the native Java extension.  Attackers can send XML documents with carefully crafted documents which can cause the XML processor to enter an infinite loop, causing the server to run out of memory and crash."

super({
  :name=>"CVE-2013-6460",
  :cvss=>"AV:N/AC:M/Au:N/C:N/I:N/A:P",
  :release_date => Date.new(2013, 12, 15),
  :cwe=>"",
  :owasp=>"A9", 
  :applies=>["rails", "sinatra", "padrino"],
  :kind=>Dawn::KnowledgeBase::COMBO_CHECK,
  :message=>message,
  :mitigation=>"Please upgrade nokogiri gem to a newer version",
  :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA", "https://access.redhat.com/security/cve/CVE-2013-6460"],
  :checks=>[CVE_2013_6460_a.new, CVE_2013_6460_b.new]
})
                      end