Описание
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
A flaw was found in Nokogiri. An integer overflow vulnerability in packaged libxml2 buffer handling functions allows a remote attacker to cause out-of-bounds memory writes. By crafting specially designed, large XML files, an attacker can trigger buffer overflows, leading to potential information disclosure, data modification, or denial of service.
Отчет
This is an Important flaw because it can lead to information disclosure, data modification, or denial of service in Red Hat products that process untrusted, specially crafted multi-gigabyte XML files. The integer overflow in the bundled libxml2 library allows an attacker to cause out-of-bounds memory writes, potentially compromising system integrity or availability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/toolbox-rhel9 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Not affected | ||
| Red Hat Hardened Images | libxml2 | Not affected | ||
| Red Hat Hardened Images | swift-lang | Not affected | ||
| Red Hat Satellite 6 | rubygem-nokogiri | Not affected | ||
| Red Hat Satellite 6 | tfm-rubygem-amazing_print | Not affected | ||
| Red Hat Satellite 6 | tfm-rubygem-graphql | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
EPSS
7 High
CVSS3