CVE-2023-54354: Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.14.3 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Which Nokogiri deployments are affected?
Affected deployments use the CRuby implementation of Nokogiri before version 1.14.3 and its packaged libxml2. The issue does not describe exposure for other Nokogiri implementations or for deployments not using the packaged libxml2.
What does an attacker need to trigger the denial of service?
An attacker needs to be able to supply a crafted or malformed XML schema that the affected application processes. Successful exploitation can cause a NULL pointer dereference and potentially segfault the process.
How can I determine whether my application is exposed?
Check whether the application uses CRuby, runs Nokogiri earlier than 1.14.3, and uses Nokogiri's packaged libxml2. Affected Nokogiri releases bundle libxml2 version 2.10.3.
What version resolves the issue?
Upgrade Nokogiri to version 1.14.3 or later. This release updates the packaged libxml2 from version 2.10.3 to 2.10.4 to address the NULL pointer dereference issues.