Skip to content
This repository has been archived by the owner on Feb 14, 2024. It is now read-only.

Nokogiri does not forbid namespace nodes in XPointer ranges #17

Open
sniffler-app bot opened this issue Apr 14, 2023 · 0 comments
Open

Nokogiri does not forbid namespace nodes in XPointer ranges #17

sniffler-app bot opened this issue Apr 14, 2023 · 0 comments
Assignees
@ls-barnaby-claydon
Labels
critical dependabot security

Comments

@sniffler-app
Copy link

sniffler-app bot commented Apr 14, 2023

Description

xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

Informations

Manifest Path: Gemfile.lock

Please look at dependabot report :https://github.com/swipely/bubz/security/dependabot/86
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@ls-barnaby-claydon ls-barnaby-claydon

Labels
critical dependabot security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ls-barnaby-claydon