GitHub Advisoryadvisory · RubyGems

GHSA-882p-jqgm-f45g Uncontrolled resource consumption in nokogiri

MEDIUM Published 2018-04-13 Modified 2023-05-04 Official page ↗
Aliases
CVE-2017-18258
Ecosystem
RubyGems
Packages
nokogiri
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2020-06-16

Affected packages

• RubyGems nokogiri: < 1.8.2 → fixed in 1.8.2

Description

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

Related

Alias · CVE (1)

  • CVE-2017-18258 The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References