Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-RUBY-NOKOGIRI-72433
- published 10 Oct 2018
- disclosed 19 Jul 2018
- credit Unknown
Introduced: 19 Jul 2018CVE-2018-14404 Open this link in a new tab
How to fix?
nokogiri to version 1.8.5 or higher.
nokogiri is an HTML, XML, SAX, and Reader parser. Among Nokogiri's features is the ability to search documents via XPath or CSS3 selectors.
Affected versions of this package are vulnerable to several Denial of Service (DoS) vulnerabilities. Nokogiri bundles the
libxml2 library, which is vulnerable in versions through 2.9.6.
A NULL pointer dereference vulnerability exists in the
xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the
XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application
--with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers
LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint
infinite loop in LZMA decompression.