Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
57 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.
Recommended action: Upgrade to 1.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data. Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
Recommended action: Upgrade to 1.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
Recommended action: Upgrade to 1.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri < v1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers. For CRuby users, this may allow specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Severity The Nokogiri maintainers have evaluated this as High 8.2 (CVSS3.1). Mitigation CRuby users should upgrade to Nokogiri = 1.13.6. JRuby users are not affected. Workarounds To avoid this vulnerability in affected applications, ensure the untrusted input is a String by calling #tos or equivalent. Credit This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.
Recommended action: Upgrade to 1.13.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from v2.9.13 to v2.9.14. libxml2 v2.9.14 addresses CVE-2022-29824. This version also includes several security-related bug fixes for which CVEs were not created, including a potential double-free, potential memory leaks, and integer-overflow. Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.13.5, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 and libxslt release announcements. Mitigation Upgrade to Nokogiri = 1.13.5. Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 = 2.9.14 which will also address these same issues. Impact libxml2 CVE-2022-29824 - CVSS3 score: - Unspecified upstream - Nokogiri…
Recommended action: Upgrade to 1.13.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A dependency of Nokogiri, libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Recommended action: Upgrade to 1.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Recommended action: Upgrade to 1.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri gem has Denial of Service via infinite loop when parsing XML documents
Recommended action: Upgrade to 1.6.1 or 1.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Recommended action: Upgrade to 1.6.1 or 1.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri before 1.5.4 is vulnerable to XXE attacks.
Recommended action: Upgrade to 1.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri v1.13.4 updates the vendored org.cyberneko.html library to 1.9.22.noko2 which addresses CVE-2022-24839. That CVE is rated 7.5 (High Severity). See GHSA-9849-p7jc-9rmv for more information. Please note that this advisory only applies to the JRuby implementation of Nokogiri < 1.13.4. Mitigation Upgrade to Nokogiri = 1.13.4. Impact CVE-2022-24839 in nekohtml - Severity: High 7.5 - Type: CWE-400 Uncontrolled Resource Consumption - Description: The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. - See also: GHSA-9849-p7jc-9rmv
Recommended action: Upgrade to 1.13.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this advisory only applies to the JRuby implementation of Nokogiri < 1.13.4. Mitigation Upgrade to Nokogiri = v1.13.4. Impact CVE-2022-23437 in xerces-J - Severity: Medium - Type: CWE-91 XML Injection (aka Blind XPath Injection) - Description: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. - See also: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
Recommended action: Upgrade to 1.13.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses CVE-2018-25032. That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05. Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.13.4, and only if the packaged version of zlib is being used. Please see this document for a complete description of which platform gems vendor zlib. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's zlib release announcements. Mitigation Upgrade to Nokogiri = v1.13.4. Impact CVE-2018-25032 in zlib - Severity: High - Type: CWE-787 Out of bounds write - Description: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Recommended action: Upgrade to 1.13.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Mitigation Upgrade to Nokogiri = 1.13.4. Severity The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1). References CWE-1333 Inefficient Regular Expression Complexity Credit This vulnerability was reported by HackerOne user oooooooq (ななおく).
Recommended action: Upgrade to 1.13.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
zlib 1.2.11 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Recommended action: Upgrade to 1.13.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri v1.13.2 upgrades two of its packaged dependencies: - vendored libxml2 from v2.9.12 to v2.9.13 - vendored libxslt from v1.1.34 to v1.1.35 Those library versions address the following upstream CVEs: - libxslt: CVE-2021-30560 (CVSS 8.8, High severity) - libxml2: CVE-2022-23308 (Unspecified severity, see more information below) Those library versions also address numerous other issues including performance improvements, regression fixes, and bug fixes, as well as memory leaks and other use-after-free issues that were not assigned CVEs. Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.13.2, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 and libxslt release announcements. Mitigation Upgrade to Nokogiri = 1.13.2. Users who are unable to upgrade Nokogiri may also choose a…
Recommended action: Upgrade to 1.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Severity The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.) Impact In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: - Nokogiri::XML::SAX::Parser - Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser - Nokogiri::XML::SAX::PushParser - Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser Mitigation JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
Recommended action: Upgrade to 1.12.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses: - CVE-2019-20388 (Medium severity) - CVE-2020-24977 (Medium severity) - CVE-2021-3517 (Medium severity) - CVE-2021-3518 (Medium severity) - CVE-2021-3537 (Low severity) - CVE-2021-3541 (Low severity) Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via xmllint is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992). Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements. Mitigation Upgrade to Nokogiri = 1.11.4. Impact I've done a brief analysis of the published CVEs that are addressed in this upstream release.…
Recommended action: Upgrade to 1.11.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Severity Nokogiri maintainers have evaluated this as Low Severity (CVSS3 2.6). Description In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. Please note that this security fix was pushed into a new minor version, 1.11.x, rather than a patch release to the 1.10.x branch, because it is a breaking change for some schemas and the risk was assessed to be "Low Severity". Affected Versions Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3 Mitigation There are no known workarounds for affected versions. Upgrade to Nokogiri 1.11.0.rc4 or later. If, after upgrading to 1.11.0.rc4 or later, you wish to re-enable network access for resolution of external…
Recommended action: Upgrade to 1.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. The Nokogiri RubyGem has patched its vendored copy of libxml2 in order to prevent this issue from affecting nokogiri.
Recommended action: Upgrade to 1.10.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#loadfile is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
Recommended action: Upgrade to 1.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATHOPAND or XPATHOPOR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Recommended action: Upgrade to 1.8.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.
Recommended action: Upgrade to 1.6.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. It was discovered that libxml2 and libxslt incorrectly handled certain malformed documents, which can allow malicious users to cause issues ranging from denial of service to remote code execution attacks.
Recommended action: Upgrade to 1.6.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.