CVE-2021-47996: Nokogiri before 1.11.4 Multiple Vulnerabilities via libxml2
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue applies only to the CRuby implementation of Nokogiri before 1.11.4 when it uses Nokogiri’s packaged or vendored libxml2. Other Ruby implementations and installations using a different libxml2 are not identified as affected by the provided data.
What must an attacker be able to do to exploit this?
An attacker needs to cause the application to process a crafted XML document. No authentication or user interaction is indicated by the supplied severity vector.
What can happen if a vulnerable application processes malicious XML?
The documented impacts include denial of service, information disclosure, and memory corruption. The bundled libxml2 version is affected by a memory leak, buffer over-read, heap-based buffer overflow, and out-of-bounds read.
What is the available remediation?
Upgrade Nokogiri to version 1.11.4 or later, which no longer bundles the affected libxml2 2.9.10 version.