CVE-2022-50998: Nokogiri before 1.13.9 Multiple Vulnerabilities via libxml2
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.13.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-40304 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-40303
Event History
Frequently Asked Questions
Which Nokogiri deployments are affected?
Affected deployments use the CRuby implementation of Nokogiri with packaged libraries and a Nokogiri version earlier than 1.13.9. The issue described is tied to the bundled libxml2 2.9.14.
What must an attacker provide to trigger the issue?
An attacker would need to cause the application to process crafted XML input. One of the referenced flaws involves entity-reference cycles, and another is triggered when parsing with XML_PARSE_HUGE.
What is the practical impact of processing malicious XML?
Processing crafted XML may cause denial of service or memory corruption. The affected libxml2 flaws include data corruption or double-free behavior and integer overflows.
What remediation is identified?
Upgrade Nokogiri to version 1.13.9, which updates its packaged libxml2 from 2.9.14 to 2.10.3. The advisory states that this addresses the relevant libxml2 issues.
Does the referenced NULL pointer dereference affect Nokogiri users?
No. Although the advisory references CVE-2022-2309, Nokogiri maintainers determined that it does not affect Nokogiri users.