Nokogiri CVE-2024-25062 Memory Corruption Vulnerability Advisory and Fix

Vulnerability Overview Nokogiri has updated its dependency library, libxml2, to versions 2.12.5 and 2.11.7 to address the CVE-2024-25062 vulnerability. This vulnerability involves potential memory corruption in the XML parser when processing specific XML documents. Affected Versions Affected versions: - Nokogiri v1.16.0 to v1.16.2 - Nokogiri v1.15.6 to v1.15.6 Unaffected versions: - Nokogiri v1.16.2 and above - Nokogiri v1.15.6 and above Remediation Upgrade Nokogiri: - Upgrade to Nokogiri v1.15.6 or v1.16.2 Alternative: - For users who cannot upgrade Nokogiri, they can compile and link Nokogiri to a patched external libxml2 library to resolve the same issue. Timeline 2024-02-04 10:35 EST: Drafted GHSA; lacked complete details regarding the introduction time of the upstream issue. 2024-02-04 10:48 EST: Updated GHSA to reflect confirmation of affected versions by libxml2 maintainers. 2024-02-04 11:54 EST: Released v1.16.2; GHSA made public. 2024-02-05 10:18 EST: Updated links to MITRE and CVE information, and updated the "Impact" section. 2024-03-18 09:03 EDT: Released v1.15.6 (see discussion #23145); updated mitigation information. 2024-03-18 22:12 EDT: Updated the scope of "Affected Products" to include v1.15.6 information. Additional Information CVE ID: No known CVE ID Weakness: CWE-416 Notes This advisory applies only to the CRuby implementation of Nokogiri using packaged libraries. If users override default settings during installation to use system libraries, they should monitor their distribution's libxml2 version announcements. JRuby users are not affected.

Goal Reached Thanks to every supporter — we hit 100%!

Nokogiri CVE-2024-25062 Memory Corruption Vulnerability Advisory and Fix

More from this source