Vulnerability Description
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nokogiri | Nokogiri | < 1.13.6 |
| Apple | Macos | >= 13.0, < 13.1 |
Related Weaknesses (CWE)
References
- https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714
- https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102aPatchThird Party Advisory
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6Release NotesThird Party Advisory
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8Issue TrackingThird Party Advisory
- https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri
- http://seclists.org/fulldisclosure/2022/Dec/23Mailing ListThird Party Advisory
- https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102aPatchThird Party Advisory
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6Release NotesThird Party Advisory
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202208-29Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/ExploitThird Party Advisory
- https://support.apple.com/kb/HT213532Third Party Advisory
FAQ
What is CVE-2022-29181?
CVE-2022-29181 is a vulnerability with a CVSS score of 8.2 (HIGH). Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted input...
How severe is CVE-2022-29181?
CVE-2022-29181 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-29181?
Check the references section above for vendor advisories and patch information. Affected products include: Nokogiri Nokogiri, Apple Macos.