New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Gemfile: Bump nokogiri version from >= 1.10.8 to >= 1.11.1 #2048

Merged

bcoles merged 1 commit into beefproject:master from bcoles:gemfile-nokogiri

Jan 26, 2021

Collaborator

bcoles commented Jan 26, 2021

Name: nokogiri
Version: 1.10.10
Advisory: CVE-2020-26247
Criticality: Low
URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m
Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Solution: upgrade to >= 1.11.0.rc4

Vulnerabilities found!

I'm not sure if BeEF is affected by this but it makes sense to enforce use of a newer and non-vulnerable version.


          Gemfile: Bump nokogiri version from >= 1.10.8 to >= 1.11.1

e447f1b

bcoles merged commit 5df9a7f into beefproject:master

bcoles deleted the gemfile-nokogiri branch

January 26, 2021 07:24

wheatley mentioned this pull request

Release BeEF version 0.5.1.0 #2039

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment