Most recent entries from all

bdu:2022-06047

Withdrawn: BELL-CVE-2022-24836 — CVE-2022-24836 does not affect BellSoft software

Withdrawn by the publisher.

BREW-mikutter-CVE-2022-24836 — Nokogiri Inefficient Regular Expression Complexity

Affected: Homebrew: mikutter

## Summary

Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.

## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.

## Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

## References

[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity

## Credit

This vulnerability was reported by HackerOne user ooooooo_q (ななおく).

certfr-2022-avi-1108 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2022-avi-1108

EUVD-2026-160953

fkie_cve-2022-24836

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

GHSA-crjr-9rc5-ghw8 — Nokogiri Inefficient Regular Expression Complexity

Affected: RubyGems: nokogiri

## Summary

Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.

## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.

## Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

## References

[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity

## Credit

This vulnerability was reported by HackerOne user ooooooo_q (ななおく).

gsd-2022-24836

OESA-2022-1644 — rubygem-nokogiri security update

Affected: openEuler:20.03-LTS-SP1: rubygem-nokogiri, openEuler:20.03-LTS-SP3: rubygem-nokogiri, openEuler:22.03-LTS: rubygem-nokogiri

Nokogiri parses and searches XML/HTML very quickly, and also has correctly implemented CSS3 selector support as well as XPath support. Nokogiri also features an Hpricot compatibility layer to help ease the change to using correct CSS and XPath.

Security Fix(es):

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri less than v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri >= 1.13.4. There are no known workarounds for this issue.(CVE-2022-24836)

openSUSE-SU-2024:11999-1 — ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

ruby3.1-rubygem-nokogiri-1.13.4-1.1 on GA media

RHSA-2022:8506 — Red Hat Security Advisory: Satellite 6.12 Release

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way django: Possible XSS via '{% debug %}' template tag nokogiri: ReDoS in HTML encoding detection ruby-git: package vulnerable to Command Injection via git argument injection rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri sinatra: path traversal possible outside of public_dir when serving static files rubygem-rails-html-sanitizer: possible xss with certain configurations python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments foreman: foreman: OAuth secret exposure via unauthenticated access to the GraphQL API

SUSE-SU-2022:3890-1 — Security update for rubygem-nokogiri

Security update for rubygem-nokogiri

UBUNTU-CVE-2022-24836

Affected: Ubuntu:Pro:14.04:LTS: ruby-nokogiri, Ubuntu:16.04:LTS: ruby-nokogiri, Ubuntu:18.04:LTS: ruby-nokogiri, Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri

WID-SEC-W-2022-2313 — Apple macOS: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um den Benutzer zu täuschen, Informationen offenzulegen, Sicherheitsmechanismen zu umgehen, Rechte zu erweitern und beliebigen Code mit Kernel-Rechten auszuführen.