Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-h58b-23z1-xkdz
|
Inefficient Regular Expression Complexity in Nokogiri
## Summary
Nokogiri `< v1.13.4` contains an inefficient regular expression that is
susceptible to excessive backtracking when attempting to detect encoding
in HTML documents.
## Mitigation
Upgrade to Nokogiri `>= 1.13.4`.
|
CVE-2022-24836
GHSA-crjr-9rc5-ghw8
|
|
VCID-unad-wpdw-jufv
|
Improper Handling of Unexpected Data Type in Nokogiri
### Summary
Nokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers.
For CRuby users, this may allow specially crafted untrusted inputs to cause illegal
memory access errors (segfault) or reads from unrelated memory.
### Severity
The Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).
### Mitigation
CRuby users should upgrade to Nokogiri `>= 1.13.6`.
JRuby users are not affected.
### Workarounds
To avoid this vulnerability in affected applications, ensure the untrusted input is a
`String` by calling `#to_s` or equivalent.
|
CVE-2022-29181
GHSA-xh29-r2w5-wx8m
|