-
-
Notifications
You must be signed in to change notification settings - Fork 217
/
CVE-2019-11068.yml
49 lines (39 loc) · 1.77 KB
/
CVE-2019-11068.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
---
gem: nokogiri
cve: 2019-11068
ghsa: qxcg-xjjg-66mj
url: https://github.com/sparklemotion/nokogiri/issues/1892
title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
date: 2019-04-22
description: |
Nokogiri v1.10.3 has been released.
This is a security release. It addresses a CVE in upstream libxslt rated as
"Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
details are available below.
If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time, though
you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that this patch is not yet (as
of 2019-04-22) in an upstream release of libxslt.
Full details about the security update are available in Github Issue
[#1892] https://github.com/sparklemotion/nokogiri/issues/1892.
---
CVE-2019-11068
Permalinks are:
- Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068
- Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068
Description:
> libxslt through 1.1.33 allows bypass of a protection mechanism
> because callers of xsltCheckRead and xsltCheckWrite permit access
> even upon receiving a -1 error code. xsltCheckRead can return -1 for
> a crafted URL that is not actually invalid and is subsequently
> loaded.
Canonical rates this as "Priority: Medium".
Debian rates this as "NVD Severity: High (attack range: remote)".
cvss_v3: 9.8
patched_versions:
- ">= 1.10.3"
related:
url:
- https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ
- https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6