CVE-2020-26247 — XXE in Nokogiri

Affected: sparklemotion nokogiri

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

USN-7659-1 — ruby-nokogiri vulnerabilities

Affected: Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri

It was discovered Nokogiri did not correctly parse XML Schemas. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-26247)

Agustin Gianni discovered that Nokogiri did not correctly parse XML and HTML files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or leak sensitive information. (CVE-2022-29181)

Most recent entries from all

CVE-2020-26247 — XXE in Nokogiri

USN-7659-1 — ruby-nokogiri vulnerabilities