Описание
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
A flaw was found in Nokogiri, an XML and HTML library for Ruby. This use-after-free vulnerability occurs when replacing the value of an XML attribute. If a Ruby wrapper already points to the attribute's child node, the underlying native child node can be freed while the wrapper remains accessible. A subsequent attempt to use the freed memory or a Ruby garbage collection operation could dereference an invalid pointer, leading to an invalid read and potentially causing a segmentation fault, resulting in a Denial of Service (DoS).
Отчет
The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child node and then replace that same attribute's value via Attr#value= or #content=. Nokogiri 1.19.4 makes this pattern safe with no change to the public API.
Меры по смягчению последствий
Upgrade to Nokogiri 1.19.4 or later. As a workaround, avoid accessing attribute child nodes directly via Attr#child or similar before mutating the same attribute's value.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/backend | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/zync | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/backend | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/zync | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp26/toolbox | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
Nokogiri is an open source XML and HTML library for the Ruby programmi ...
EPSS
3.7 Low
CVSS3