Most recent entries from all

bdu:2024-02313

Withdrawn: BELL-CVE-2022-29181 — CVE-2022-29181 does not affect BellSoft software

Withdrawn by the publisher.

BREW-mikutter-CVE-2022-29181 — Nokogiri Improperly Handles Unexpected Data Type

Affected: Homebrew: mikutter

### Summary

Nokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers. For CRuby users, this may allow specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory.

### Severity

The Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).

### Mitigation

CRuby users should upgrade to Nokogiri `>= 1.13.6`.

JRuby users are not affected.

### Workarounds

To avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

### Credit

This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.

certfr-2022-avi-1108 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2022-avi-1108

EUVD-2026-241322

fkie_cve-2022-29181

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

GHSA-xh29-r2w5-wx8m — Nokogiri Improperly Handles Unexpected Data Type

Affected: RubyGems: nokogiri

### Summary

### Severity

The Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).

### Mitigation

CRuby users should upgrade to Nokogiri `>= 1.13.6`.

JRuby users are not affected.

### Workarounds

To avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

### Credit

This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.

gsd-2022-29181

openSUSE-SU-2024:12085-1 — ruby3.1-rubygem-nokogiri-1.13.6-1.1 on GA media

ruby3.1-rubygem-nokogiri-1.13.6-1.1 on GA media

RHSA-2022:8506 — Red Hat Security Advisory: Satellite 6.12 Release

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way django: Possible XSS via '{% debug %}' template tag nokogiri: ReDoS in HTML encoding detection ruby-git: package vulnerable to Command Injection via git argument injection rubygem-nokogiri: Improper Handling of Unexpected Data Type in Nokogiri sinatra: path traversal possible outside of public_dir when serving static files rubygem-rails-html-sanitizer: possible xss with certain configurations python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments foreman: foreman: OAuth secret exposure via unauthenticated access to the GraphQL API

SUSE-SU-2022:3890-1 — Security update for rubygem-nokogiri

Security update for rubygem-nokogiri

UBUNTU-CVE-2022-29181

Affected: Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri

WID-SEC-W-2022-1935 — Microsoft GitHub Enterprise: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.