netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-xh29-r2w5-wx8m

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-27 14:52:42 +00:00
parent 52c3a243ef
commit f860147727
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-xh29-r2w5-wx8m/GHSA-xh29-r2w5-wx8m.json
+6 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xh29-r2w5-wx8m",
"modified": "2022-08-19T18:49:14Z",
"modified": "2025-05-27T14:51:05Z",
"published": "2022-05-23T23:15:15Z",
"aliases": [
"CVE-2022-29181"
],
"summary": "Nokogiri Improperly Handles Unexpected Data Type",
"details": "### Summary\n\nNokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers. For CRuby users, this may allow specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).\n\n\n### Mitigation\n\nCRuby users should upgrade to Nokogiri `>= 1.13.6`.\n\nJRuby users are not affected.\n\n\n### Workarounds\n\nTo avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.\n\n\n### Credit\n\nThis vulnerability was responsibly reported by @agustingianni and the Github Security Lab.\n",
"details": "### Summary\n\nNokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers. For CRuby users, this may allow specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).\n\n\n### Mitigation\n\nCRuby users should upgrade to Nokogiri `>= 1.13.6`.\n\nJRuby users are not affected.\n\n\n### Workarounds\n\nTo avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.\n\n\n### Credit\n\nThis vulnerability was responsibly reported by @agustingianni and the Github Security Lab.",
"severity": [
{
"type": "CVSS_V3",
@@ -44,6 +44,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29181"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267"