GitHub Advisoryadvisory · RubyGems
GHSA-3x8r-x6xp-q4vm Uncontrolled Recursion in Loofah
HIGH
Official page ↗
- Aliases
- CVE-2022-23516
- Ecosystem
- RubyGems
- Packages
- loofah
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-674
- Reviewed
- 2022-12-13
Affected packages
• RubyGems loofah: >= 2.2.0, < 2.19.1 → fixed in 2.19.1
Description
Summary
Loofah `>= 2.2.0, = 2.19.1`.
Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
Severity
The Loofah maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
• CWE - CWE-674: Uncontrolled Recursion (4.9)
Related
Alias · CVE (1)
- CVE-2022-23516 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. vulnerability
Weakness · CWE (1)
- CWE-674 Uncontrolled Recursion weakness
References
- https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm web
- https://nvd.nist.gov/vuln/detail/CVE-2022-23516 advisory
- https://github.com/flavorjones/loofah/commit/86f7f6364491b0099d215db858ecdc0c89ded040 web
- https://github.com/flavorjones/loofah package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2022-23516.yml web
- https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html web
- https://lists.debian.org/debian-lts-announce/2024/09/msg00044.html web