CVE-2022-51000: Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt
Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory disclosure, or code execution. Nokogiri 1.13.2 upgrades vendored libxml2 to 2.9.13 and libxslt to 1.1.35.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.13.2 - Compensating control
If using a Nokogiri version before 1.13.2, avoid transforming XML with untrusted XSL stylesheets to mitigate the libxslt CVE-2021-30560 denial-of-service risk.
- Compensating control
If using a Nokogiri version before 1.13.2, avoid parsing untrusted documents with parse option DTDVALID set to true and NOENT set to false to mitigate the libxml2 CVE-2022-23308 denial-of-service, memory disclosure, or code execution risk.
Event History
Frequently Asked Questions
Which deployments are exposed to the libxslt issue?
CRuby deployments of Nokogiri before 1.13.2 that use packaged libraries are affected when they transform XML using untrusted XSL stylesheets. The stated impact for this path is denial of service.
What parser configuration is required for the libxml2 issue to be reachable?
The application must parse an untrusted document with the DTDVALID parse option set to true and the NOENT option set to false. Under those conditions, the issue may allow denial of service, memory disclosure, or code execution.
What version resolves the bundled-library exposure?
Upgrade Nokogiri to 1.13.2. This version updates the vendored libxml2 library to 2.9.13 and libxslt to 1.1.35.