-
-
Notifications
You must be signed in to change notification settings - Fork 217
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add CVE-2018-14404 and CVE-2018-14567 for nokogiri
- Loading branch information
Showing
1 changed file
with
69 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,69 @@ | ||
--- | ||
gem: nokogiri | ||
cve: 2018-14404 | ||
date: 2018-10-04 | ||
url: https://github.com/sparklemotion/nokogiri/issues/1785 | ||
title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities | ||
description: | | ||
Nokogiri 1.8.5 has been released. | ||
This is a security and bugfix release. It addresses two CVEs in upstream | ||
libxml2 rated as "medium" by Red Hat, for which details are below. | ||
If you're using your distro's system libraries, rather than Nokogiri's | ||
vendored libraries, there's no security need to upgrade at this time, | ||
though you may want to check with your distro whether they've patched this | ||
(Canonical has patched Ubuntu packages). Note that these patches are not | ||
yet (as of 2018-10-04) in an upstream release of libxml2. | ||
Full details about the security update are available in Github Issue #1785. | ||
[#1785]: https://github.com/sparklemotion/nokogiri/issues/1785 | ||
----- | ||
[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404 | ||
and CVE-2018-14567. Full details are available in #1785. Note that these | ||
patches are not yet (as of 2018-10-04) in an upstream release of libxml2. | ||
----- | ||
CVE-2018-14404 | ||
Permalink: | ||
https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html | ||
Description: | ||
A NULL pointer dereference vulnerability exists in the | ||
xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when | ||
parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR | ||
case. Applications processing untrusted XSL format inputs with the use of | ||
the libxml2 library may be vulnerable to a denial of service attack due | ||
to a crash of the application | ||
Canonical rates this vulnerability as "Priority: Medium" | ||
----- | ||
CVE-2018-14567 | ||
Permalink: | ||
https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html | ||
Description: | ||
infinite loop in LZMA decompression | ||
Canonical rates this vulnerability as "Priority: Medium" | ||
patched_versions: | ||
- ">= 1.8.5" | ||
related: | ||
cve: | ||
- 2018-14567 | ||
url: | ||
- https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ | ||
- https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594 | ||
- https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74 |