Nokogiri v1.13.2 upgrades two of its packaged dependencies:
Those library versions address the following upstream CVEs:
Those library versions also address numerous other issues including performance
improvements, regression fixes, and bug fixes, as well as memory leaks and other
use-after-free issues that were not assigned CVEs.
Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.13.2, and only if the packaged libraries are being used. If youβve
overridden defaults at installation time to use system libraries instead of
packaged libraries, you should instead pay attention to your distroβs libxml2
and libxslt
release announcements.
Upgrade to Nokogiri >= 1.13.2.
Users who are unable to upgrade Nokogiri may also choose a more complicated
mitigation: compile and link an older version Nokogiri against external libraries
libxml2 >= 2.9.13 and libxslt >= 1.1.35, which will also address these same CVEs.
Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c
All versions of libxslt prior to v1.1.35 are affected.
Applications using untrusted XSL stylesheets to transform XML are vulnerable to
a denial-of-service attack and should be upgraded immediately.
libxml2 CVE-2022-23308
The upstream commit and the explanation linked above indicate that an application
may be vulnerable to a denial of service, memory disclosure, or code execution if
it parses an untrusted document with parse options DTDVALID
set to true, and NOENT
set to false.
An analysis of these parse options:
NOENT
is off by default for Document, DocumentFragment, Reader, andDTDVALID
is an option that Nokogiri does not set for any operations, and soIt seems reasonable to assume that any application explicitly setting the parse
option DTDVALID
when parsing untrusted documents is vulnerable and should be
upgraded immediately.