CVE-2023-54354: Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.14.3 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.10.4Patch CVE-2023-28484
Event History
Frequently Asked Questions
Which Nokogiri deployments are affected?
Affected deployments use the CRuby implementation of Nokogiri before version 1.14.3 and its packaged libxml2. The issue does not describe exposure for other Nokogiri implementations or for deployments not using the packaged libxml2.
What does an attacker need to trigger the denial of service?
An attacker needs to be able to supply a crafted or malformed XML schema that the affected application processes. Successful exploitation can cause a NULL pointer dereference and potentially segfault the process.
How can I determine whether my application is exposed?
Check whether the application uses CRuby, runs Nokogiri earlier than 1.14.3, and uses Nokogiri's packaged libxml2. Affected Nokogiri releases bundle libxml2 version 2.10.3.
What version resolves the issue?
Upgrade Nokogiri to version 1.14.3 or later. This release updates the packaged libxml2 from version 2.10.3 to 2.10.4 to address the NULL pointer dereference issues.