GitHub Advisoryadvisory · RubyGems

GHSA-2rr5-8q37-2w7h Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

HIGH Published 2021-09-27 Modified 2021-09-28 Official page ↗
Aliases
CVE-2021-41098
Ecosystem
RubyGems
Packages
nokogiri
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2021-09-27

Affected packages

• RubyGems nokogiri: < 1.12.5 → fixed in 1.12.5

Description

Severity The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.) Impact In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: • Nokogiri::XML::SAX::Parser • Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser • Nokogiri::XML::SAX::PushParser • Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser Mitigation JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.

Related

Alias · CVE (1)

  • CVE-2021-41098 Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References