Use After Free Affecting nokogiri package, versions <1.19.5

nokogiri is a gem for parsing HTML, XML, SAX, and Reader.

Affected versions of this package are vulnerable to Use After Free via the set and set_lang functions in the CRuby native extension. When application code accesses an XML attribute’s child nodes and then replaces that same attribute’s value with Node#[]= or Node#lang=, the native code can free those nodes while their Ruby wrappers remain reachable; using a retained wrapper can cause an invalid memory read and possible segfault. JRuby is not affected.

Notes

• After Node#[]= or Node#lang= replaces the attribute value, the application must use a previously wrapped child node; that later access is what triggers the invalid read or possible crash.

Workarounds

• Avoid accessing an attribute’s child nodes via Attr#children or similar before replacing that same attribute’s value; this prevents the replacement from leaving Ruby wrappers pointing to freed memory.

• GitHub ChangeLog
• GitHub Commit
• GitHub Commit v1.19.5
• Maintainer's Advisory