CVE-2012-6685 Nokogiri is vulnerable to XML External Entity (XXE) attack
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Nokogiri before 1.5.4 is vulnerable to XXE attacks
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems nokogiri(RubyGems) | < 1.5.4 | 1.5.4 |
| rubygems nokogiri(RubyGems) | = 1.0.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.1.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.1.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.2.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.3.1 | No fix listed |
Show 35 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems nokogiri(RubyGems) | = 1.4.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.4.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.4.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.1.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4.rc3 | No fix listed |
| debian/ruby-nokogiri(Debian:12) | < 1.5.4-1 | 1.5.4-1 |
| debian/ruby-nokogiri(Debian:13) | < 1.5.4-1 | 1.5.4-1 |
| debian/ruby-nokogiri(Debian:14) | < 1.5.4-1 | 1.5.4-1 |
| nokogiri | < 1.5.4 | 1.5.4 |
| redhat cloudforms management engine | = 5.0 | No fix listed |
| redhat openshift | = 2.0 | No fix listed |
| redhat openstack | = 4.0 | No fix listed |
| redhat openstack | = 6.0 | No fix listed |
| redhat openstack foreman | All versions | No fix listed |
| redhat satellite | = 6.0 | No fix listed |
| redhat subscription asset manager | All versions | No fix listed |
| redhat enterprise mrg | = 2.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit issue-tracking third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- nokogiri.org release-notes vendor-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2012-6685 vendor-advisory