Denial of Service (DoS) Affecting nokogiri package, versions <1.8.5
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-NOKOGIRI-72433
- published 10 Oct 2018
- disclosed 19 Jul 2018
- credit Unknown
Introduced: 19 Jul 2018
CVE-2018-14404 Open this link in a new tabHow to fix?
Upgrade nokogiri to version 1.8.5 or higher.
Overview
nokogiri is an HTML, XML, SAX, and Reader parser. Among Nokogiri's features is the ability to search documents via XPath or CSS3 selectors.
Affected versions of this package are vulnerable to several Denial of Service (DoS) vulnerabilities. Nokogiri bundles the libxml2 library, which is vulnerable in versions through 2.9.6.
CVE-2018-14404
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application
CVE-2018-14567
If --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint
infinite loop in LZMA decompression.