Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

2024-05-1316:05:42

Google

osv.dev

nokogiri

libxml2

v2.12.7

cve-2024-34459

security update

6.7 Medium

AI Score

Confidence

Low

JSON

Summary

Nokogiri v1.16.5 upgrades its dependency libxml2 to 2.12.7 from 2.12.6.

libxml2 v2.12.7 addresses CVE-2024-34459:

described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53

Impact

There is no impact to Nokogiri users because the issue is present only in libxml2’s xmllint tool which Nokogiri does not provide or expose.

Timeline

2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced
2024-05-13 08:30 EDT, nokogiri maintainers begin triage
2024-05-13 10:05 EDT, nokogiri v1.16.5 is released and this GHSA made public

CPENameOperatorVersion
nokogirieq1.5.7.rc2
nokogirieq1.10.9
nokogirieq1.5.3.rc6
nokogirieq1.4.2
nokogirieq1.0.5
nokogirieq1.12.1
nokogirieq1.6.7.rc3
nokogirieq1.5.0
nokogirieq1.3.0
nokogirieq1.6.7.2

Name	Operator	Version
nokogiri	eq	1.5.7.rc2
nokogiri	eq	1.10.9
nokogiri	eq	1.5.3.rc6
nokogiri	eq	1.4.2
nokogiri	eq	1.0.5
nokogiri	eq	1.12.1
nokogiri	eq	1.6.7.rc3
nokogiri	eq	1.5.0
nokogiri	eq	1.3.0
nokogiri	eq	1.6.7.2