CVE-2024-58378: Nokogiri before 1.16.2 Use-After-Free via xmlTextReader
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.15.6 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.16.2 - Compensating control
If using Nokogiri versions before 1.15.6 and 1.16.x before 1.16.2 with DTD validation and XInclude expansion enabled via the XML Reader interface (Nokogiri::XML::Reader), disable DTD validation and/or XInclude expansion to prevent the crafted-XML use-after-free triggered in libxml2 xmlTextReader (CVE-2024-25062, xmlValidatePopElement).
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use CRuby with Nokogiri before 1.15.6, or a 1.16.x release before 1.16.2, when Nokogiri uses its packaged libxml2. JRuby and installations configured to use system libxml2 are not affected.
What conditions are required to trigger the issue?
An application must process an attacker-crafted XML document through Nokogiri::XML::Reader with both DTD validation and XInclude expansion enabled. The vulnerable code path is in libxml2's xmlTextReader module.
What versions remediate the vulnerability?
Upgrade to Nokogiri 1.15.6 or 1.16.2. These releases update the packaged libxml2 to versions 2.11.7 and 2.12.5, respectively.