Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate libxml2 vulnerabilities patched in USN-4274-1 #1992

Closed
flavorjones opened this issue Feb 10, 2020 · 4 comments
Closed

Investigate libxml2 vulnerabilities patched in USN-4274-1 #1992

flavorjones opened this issue Feb 10, 2020 · 4 comments

Comments

@flavorjones
Copy link
Member

@flavorjones flavorjones commented Feb 10, 2020

This issue is to drive investigation and potential action around a set of upstream patches that Canonical judged valuable enough to port to their distributions.

References:


Summary

Synthesis

CVE-2019-19956 was addressed in upstream libxml2 release v2.9.10, which has been vendored in Nokogiri since v1.10.5 on 2019-10-31.

CVE-2020-7595 has not yet been addressed in an upstream libxml2 release, and so Nokogiri versions <= v1.10.7 are vulnerable.

Actions

Nokogiri has backported the patch for CVE-2020-7595 into its vendored version of libxml2, and released this as v1.10.8: https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.8

If you are using Nokogiri <= v1.10.7, please upgrade to v1.10.8 or later.


History of this notification

  • 2020-02-10: USN-4274-1 published by Canonical
  • 2020-02-10: this github issue created
  • 2020-02-10: Nokogiri v1.10.8 is released with patched libxml2
@flavorjones
Copy link
Member Author

@flavorjones flavorjones commented Feb 10, 2020

Analysis

CVE-2019-19956

permalink: https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19956.html

bug report: https://gitlab.gnome.org/GNOME/libxml2/issues/82

description:

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

priority: low

fix commit: https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549

in upstream libxml2 release?

$ git tag --contains 5a02583c7e683896d84878bd90641d8d9b0d0549
v2.9.10
v2.9.10-rc1

CVE-2020-7595

permalink: https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-7595.html

bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582

description:

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

priority: medium

fix commit: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5

in upstream libxml2 release?

$ git tag --contains 0e1a49c8907645d2e155f0d89d4d9895ac5112b5
# no, not in an upstream release
@flavorjones
Copy link
Member Author

@flavorjones flavorjones commented Feb 10, 2020

Synthesis

CVE-2019-19956 was addressed in upstream libxml2 release v2.9.10, which has been vendored in Nokogiri since v1.10.5 on 2019-10-31.

CVE-2020-7595 has not yet been addressed in an upstream libxml2 release, and so Nokogiri versions <= v1.10.7 are vulnerable.

Recommendations

Nokogiri should backport the patch for CVE-2020-7595 into its vendored version of libxml2.

flavorjones added a commit that referenced this issue Feb 10, 2020
related to #1992
@flavorjones flavorjones linked a pull request that will close this issue Feb 10, 2020
flavorjones added a commit that referenced this issue Feb 10, 2020
related to #1992
@flavorjones flavorjones reopened this Feb 10, 2020
@flavorjones
Copy link
Member Author

@flavorjones flavorjones commented Feb 10, 2020

Patch has been backported onto master. Now waiting for the v1.10.x branch to go green so I can cut a patch release.

@flavorjones flavorjones added this to the v1.10.x patch releases milestone Feb 10, 2020
flavorjones added a commit that referenced this issue Feb 10, 2020
related to #1992
flavorjones added a commit that referenced this issue Feb 10, 2020
related to #1992
@flavorjones
Copy link
Member Author

@flavorjones flavorjones commented Feb 10, 2020

Aupajo added a commit to trineo/kiwi-ruby-haiku that referenced this issue Feb 12, 2020
Patches a Nokogiri vulnerability. sparklemotion/nokogiri#1992
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this issue Feb 16, 2020
Upstream changelog (from CHANGELOG.md):

## 1.10.8 / 2020-02-10

### Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595.
Full details are available in [#1992](sparklemotion/nokogiri#1992).
Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.
primeos added a commit to NixOS/nixpkgs that referenced this issue Feb 28, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992
primeos added a commit to NixOS/nixpkgs that referenced this issue Feb 28, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992
primeos added a commit to NixOS/nixpkgs that referenced this issue Feb 28, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992
primeos added a commit to NixOS/nixpkgs that referenced this issue Feb 28, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992

(cherry picked from commit a0d61c0)
primeos added a commit to NixOS/nixpkgs that referenced this issue Feb 28, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992

(cherry picked from commit 9b0defc)
primeos added a commit to NixOS/nixpkgs that referenced this issue Feb 28, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992

(cherry picked from commit ad0c620)
dtzWill added a commit to dtzWill/nixpkgs that referenced this issue Feb 29, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992

(cherry picked from commit a0d61c0)
dtzWill added a commit to dtzWill/nixpkgs that referenced this issue Feb 29, 2020
This updates nokogiri to 1.10.8 for CVE-2020-7595 [0].

[0]: sparklemotion/nokogiri#1992

(cherry picked from commit ad0c620)
skykanin added a commit to skykanin/nixpkgs that referenced this issue Mar 5, 2020
skykanin added a commit to skykanin/nixpkgs that referenced this issue Mar 5, 2020
skykanin added a commit to skykanin/nixpkgs that referenced this issue Mar 5, 2020
dasj19 added a commit to dasj19/nixpkgs that referenced this issue Mar 12, 2020
dasj19 added a commit to dasj19/nixpkgs that referenced this issue Mar 12, 2020
dasj19 added a commit to dasj19/nixpkgs that referenced this issue Mar 12, 2020
senid231 added a commit to senid231/didww-v3-rails-sample that referenced this issue Feb 10, 2021
Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8166
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
Title: Ability to forge per-form CSRF tokens given a global CSRF token
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: actionpack
Version: 5.1.4
Advisory: CVE-2020-8164
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
Title: Possible Strong Parameters Bypass in ActionPack
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-15169
Criticality: Unknown
URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
Title: Potential XSS vulnerability in Action View
Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-8167
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
Title: CSRF Vulnerability in rails-ujs
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5418
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
Title: File Content Disclosure in Action View
Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3

Name: actionview
Version: 5.1.4
Advisory: CVE-2020-5267
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
Title: Possible XSS vulnerability in ActionView
Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2

Name: actionview
Version: 5.1.4
Advisory: CVE-2019-5419
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
Title: Denial of Service Vulnerability in Action View
Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1

Name: activejob
Version: 5.1.4
Advisory: CVE-2018-16476
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
Title: Broken Access Control vulnerability in Active Job
Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1

Name: activesupport
Version: 5.1.4
Advisory: CVE-2020-8165
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1

Name: ffi
Version: 1.9.18
Advisory: CVE-2018-1000201
Criticality: High
URL: https://github.com/ffi/ffi/releases/tag/1.9.24
Title: ruby-ffi DDL loading issue on Windows OS
Solution: upgrade to >= 1.9.24

Name: jquery-rails
Version: 4.3.1
Advisory: CVE-2019-11358
Criticality: Medium
URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
Title: Prototype pollution attack through jQuery $.extend
Solution: upgrade to >= 4.3.4

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-8048
Criticality: Unknown
URL: flavorjones/loofah#144
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.1

Name: loofah
Version: 2.1.1
Advisory: CVE-2018-16468
Criticality: Medium
URL: flavorjones/loofah#154
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.2.3

Name: loofah
Version: 2.1.1
Advisory: CVE-2019-15587
Criticality: Medium
URL: flavorjones/loofah#171
Title: Loofah XSS Vulnerability
Solution: upgrade to >= 2.3.1

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2017-15412
Criticality: Unknown
URL: sparklemotion/nokogiri#1714
Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Solution: upgrade to >= 1.8.2

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-8048
Criticality: Unknown
URL: sparklemotion/nokogiri#1746
Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS
Solution: upgrade to >= 1.8.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-26247
Criticality: Low
URL: GHSA-vr8q-g5c7-m54m
Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Solution: upgrade to >= 1.11.0.rc4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2018-14404
Criticality: Unknown
URL: sparklemotion/nokogiri#1785
Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.8.5

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-11068
Criticality: Unknown
URL: sparklemotion/nokogiri#1892
Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability
Solution: upgrade to >= 1.10.3

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2020-7595
Criticality: High
URL: sparklemotion/nokogiri#1992
Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation
Solution: upgrade to >= 1.10.8

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-5477
Criticality: Critical
URL: sparklemotion/nokogiri#1915
Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
Solution: upgrade to >= 1.10.4

Name: nokogiri
Version: 1.8.1
Advisory: CVE-2019-13117
Criticality: Unknown
URL: sparklemotion/nokogiri#1943
Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
Solution: upgrade to >= 1.10.5

Name: rack
Version: 2.0.8
Advisory: CVE-2020-8161
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
Title: Directory traversal in Rack::Directory app bundled with Rack
Solution: upgrade to ~> 2.1.3, >= 2.2.0

Name: rack
Version: 2.0.8
Advisory: CVE-2020-8184
Criticality: Unknown
URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Solution: upgrade to ~> 2.1.4, >= 2.2.3

Name: rails-html-sanitizer
Version: 1.0.3
Advisory: CVE-2018-3741
Criticality: Unknown
URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ
Title: XSS vulnerability in rails-html-sanitizer
Solution: upgrade to >= 1.0.4

Name: sprockets
Version: 3.7.1
Advisory: CVE-2018-3760
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k
Title: Path Traversal in Sprockets
Solution: upgrade to >= 2.12.5, < 3.0.0, >= 3.7.2, < 4.0.0, >= 4.0.0.beta8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

1 participant