A vulnerability has been discovered in Nokogiri, which can lead to a denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/nokogiri | * | < 1.13.10 | >= 1.13.10 |
Nokogiri is an HTML, XML, SAX, and Reader parser.
A denial of service vulnerability has been discovered in Nokogiri. Please review the CVE identifier referenced below for details.
Nokogiri fails to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack.
Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
All Nokogiri users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/nokogiri-1.13.10"
Multiple vulnerabilities have been discovered in Nokogiri, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/nokogiri | * | < 1.13.6 | >= 1.13.6 |
Nokogiri is an HTML, XML, SAX, and Reader parser.
Multiple vulnerabilities have been discovered in Nokogiri. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Nokogiri users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/nokogiri-1.13.6"
Nokogiri has a vulnerability allowing arbitrary execution of code if a certain function is used.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/nokogiri | * | < 1.10.4 | >= 1.10.4 |
Nokogiri is an HTML, XML, SAX, and Reader parser.
A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Ruby’s Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.
A remote attacker could possibly execute arbitrary code with the privileges of the process.
Avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file with untrusted user input.
All Nokogiri users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/nokogiri-1.10.4"