Skip to content

Commit 659b10a

Browse files
rakviumrakvium
committed
GHSA SYNC: new advisories
- gems/Autolab/CVE-2024-49376.yml - gems/alchemy_cms/CVE-2018-18307.yml - gems/camaleon_cms/GHSA-3hp8-6j24-m5gm.yml - gems/fluentd-ui/CVE-2020-21514.yml - gems/fluentd/CVE-2020-21514.yml - gems/nokogiri/GHSA-fq42-c5rg-92c2.yml - gems/nokogiri/GHSA-gx8x-g87m-h5q6.yml - gems/nokogiri/GHSA-v6gp-9mmm-c6p5.yml - gems/nokogiri/GHSA-vcc3-rw6f-jv97.yml - gems/nokogiri/GHSA-xxx9-3xcr-gjj3.yml - gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml - gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml - gems/rails/CVE-2024-26143.yml - gems/spree_auth_devise/GHSA-6mqr-q86q-6gwr.yml - gems/spree_auth_devise/GHSA-8xfw-5q82-3652.yml - gems/spree_auth_devise/GHSA-gpqc-4pp7-5954.yml - gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml - gems/webrick/CVE-2009-4492.yml
1 parent 1f5c25f commit 659b10a

18 files changed

+639
-0
lines changed

‎gems/Autolab/CVE-2024-49376.yml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
gem: Autolab
3+
cve: 2024-49376
4+
ghsa: v46j-h43h-rwrm
5+
url: https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
6+
title: Autolab Misconfigured Reset Password Permissions
7+
date: 2024-10-25
8+
description: |
9+
### Impact
10+
For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords.
11+
12+
### Patches
13+
This is fixed in v3.0.1.
14+
15+
### Workarounds
16+
No workarounds.
17+
18+
### For more information
19+
If you have any questions or comments about this advisory:
20+
21+
Open an issue in https://github.com/autolab/Autolab/
22+
Email us at [autolab-dev@andrew.cmu.edu](mailto:autolab-dev@andrew.cmu.edu)
23+
cvss_v3: 8.8
24+
cvss_v4: 7.1
25+
unaffected_versions:
26+
- "< 3.0.0"
27+
patched_versions:
28+
- ">= 3.0.1"
29+
related:
30+
url:
31+
- https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
32+
- https://nvd.nist.gov/vuln/detail/CVE-2024-49376
33+
- https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b
34+
- https://github.com/advisories/GHSA-v46j-h43h-rwrm

‎gems/alchemy_cms/CVE-2018-18307.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
gem: alchemy_cms
3+
cve: 2018-18307
4+
ghsa: 7mj4-2984-955f
5+
url: http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
6+
title: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
7+
date: 2022-05-14
8+
description: |
9+
A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS
10+
via the /admin/pictures image filename field.
11+
cvss_v3: 5.9
12+
unaffected_versions:
13+
- "< 4.1.0"
14+
notes: Never patched
15+
related:
16+
url:
17+
- https://nvd.nist.gov/vuln/detail/CVE-2018-18307
18+
- http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
19+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15
20+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5
21+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21
22+
- https://github.com/advisories/GHSA-7mj4-2984-955f

‎gems/camaleon_cms/GHSA-3hp8-6j24-m5gm.yml

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
gem: camaleon_cms
3+
ghsa: 3hp8-6j24-m5gm
4+
url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
5+
title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
6+
date: 2024-09-23
7+
description: |
8+
The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.
9+
10+
Arbitrary file deletion can be exploited with following code path:
11+
The parameter folder flows from the actions method:
12+
```ruby
13+
def actions
14+
authorize! :manage, :media if params[:media_action] != 'crop_url'
15+
params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
16+
case params[:media_action]
17+
[..]
18+
when 'del_file'
19+
cama_uploader.delete_file(params[:folder].gsub('//', '/'))
20+
render plain: ''
21+
```
22+
into the method delete_file of the CamaleonCmsLocalUploader
23+
class (when files are uploaded locally):
24+
```ruby
25+
def delete_file(key)
26+
file = File.join(@root_folder, key)
27+
FileUtils.rm(file) if File.exist? file
28+
@instance.hooks_run('after_delete', key)
29+
get_media_collection.find_by_key(key).take.destroy
30+
end
31+
```
32+
Where it is joined in an unchecked manner with the root folder and
33+
then deleted.
34+
35+
**Proof of concept**
36+
The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
37+
```
38+
curl --path-as-is -i -s -k -X $'POST' \
39+
-H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
40+
-b $'auth_token=[..]; _cms_session=[..]' \
41+
--data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
42+
2F..
43+
2F..
44+
2FREADME.md&media_action=del_file' \
45+
$'https://<camaleon-host>/admin/media/actions?actions=true'
46+
```
47+
48+
**Impact**
49+
50+
This issue may lead to a defective CMS or system.
51+
52+
**Remediation**
53+
54+
Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the
55+
targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.
56+
57+
**See also:**
58+
59+
[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
60+
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
61+
patched_versions:
62+
- ">= 2.8.1"
63+
related:
64+
url:
65+
- https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
66+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml
67+
- https://github.com/advisories/GHSA-3hp8-6j24-m5gm

‎gems/fluentd-ui/CVE-2020-21514.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
gem: fluentd-ui
3+
cve: 2020-21514
4+
ghsa: wrxf-x8rm-6ggg
5+
url: https://github.com/fluent/fluentd/issues/2722
6+
title: Fluent Fluentd and Fluent-ui use default password
7+
date: 2023-04-04
8+
description: |
9+
An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
10+
that allows attackers to gain escilated privileges and execute arbitrary code due
11+
to use of a default password.
12+
cvss_v3: 8.8
13+
notes: Never patched
14+
related:
15+
url:
16+
- https://nvd.nist.gov/vuln/detail/CVE-2020-21514
17+
- https://github.com/fluent/fluentd/issues/2722
18+
- https://github.com/advisories/GHSA-wrxf-x8rm-6ggg

‎gems/fluentd/CVE-2020-21514.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
gem: fluentd
3+
cve: 2020-21514
4+
ghsa: wrxf-x8rm-6ggg
5+
url: https://github.com/fluent/fluentd/issues/2722
6+
title: Fluent Fluentd and Fluent-ui use default password
7+
date: 2023-04-04
8+
description: |
9+
An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
10+
that allows attackers to gain escilated privileges and execute arbitrary code due
11+
to use of a default password.
12+
cvss_v3: 8.8
13+
notes: Never patched
14+
related:
15+
url:
16+
- https://nvd.nist.gov/vuln/detail/CVE-2020-21514
17+
- https://github.com/fluent/fluentd/issues/2722
18+
- https://github.com/advisories/GHSA-wrxf-x8rm-6ggg

‎gems/nokogiri/GHSA-fq42-c5rg-92c2.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
gem: nokogiri
3+
ghsa: fq42-c5rg-92c2
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
5+
title: Vulnerable dependencies in Nokogiri
6+
date: 2022-02-25
7+
description: |
8+
### Summary
9+
10+
Nokogiri [v1.13.2](https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2) upgrades two of its packaged dependencies:
11+
12+
- vendored libxml2 from v2.9.12 to [v2.9.13](https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news)
13+
- vendored libxslt from v1.1.34 to [v1.1.35](https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news)
14+
15+
Those library versions address the following upstream CVEs:
16+
17+
- libxslt: [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) (CVSS 8.8, High severity)
18+
- libxml2: [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308) (Unspecified severity, see more information below)
19+
20+
Those library versions also address numerous other issues including performance improvements, regression fixes, and bug fixes, as well as memory leaks and other use-after-free issues that were not assigned CVEs.
21+
22+
Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.2`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.
23+
24+
25+
### Mitigation
26+
27+
Upgrade to Nokogiri `>= 1.13.2`.
28+
29+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link an older version Nokogiri against external libraries libxml2 `>= 2.9.13` and libxslt `>= 1.1.35`, which will also address these same CVEs.
30+
31+
32+
### Impact
33+
34+
#### libxslt [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560)
35+
36+
- CVSS3 score: 8.8 (High)
37+
- Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c
38+
39+
All versions of libxslt prior to v1.1.35 are affected.
40+
41+
Applications using **untrusted** XSL stylesheets to transform XML are vulnerable to a denial-of-service attack and should be upgraded immediately.
42+
43+
44+
#### libxml2 [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308)
45+
46+
- As of the time this security advisory was published, there is no officially published information available about this CVE's severity. The above NIST link does not yet have a published record, and the libxml2 maintainer has declined to provide a severity score.
47+
- Fixed by https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12
48+
- Further explanation is at https://mail.gnome.org/archives/xml/2022-February/msg00015.html
49+
50+
The upstream commit and the explanation linked above indicate that an application may be vulnerable to a denial of service, memory disclosure, or code execution if it parses an **untrusted** document with parse options `DTDVALID` set to true, and `NOENT` set to false.
51+
52+
An analysis of these parse options:
53+
54+
- While `NOENT` is off by default for Document, DocumentFragment, Reader, and Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri v1.12.0 and later.
55+
- `DTDVALID` is an option that Nokogiri does not set for any operations, and so this CVE applies only to applications setting this option explicitly.
56+
57+
It seems reasonable to assume that any application explicitly setting the parse option `DTDVALID` when parsing **untrusted** documents is vulnerable and should be upgraded immediately.
58+
cvss_v3: 8.8
59+
patched_versions:
60+
- ">= 1.13.2"
61+
related:
62+
url:
63+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
64+
- https://github.com/advisories/GHSA-fq42-c5rg-92c2

‎gems/nokogiri/GHSA-gx8x-g87m-h5q6.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
gem: nokogiri
3+
ghsa: gx8x-g87m-h5q6
4+
url: https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
5+
title: Denial of Service (DoS) in Nokogiri on JRuby
6+
date: 2022-04-11
7+
description: |
8+
## Summary
9+
10+
Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).
11+
12+
See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.
13+
14+
Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.
15+
16+
17+
## Mitigation
18+
19+
Upgrade to Nokogiri `>= 1.13.4`.
20+
21+
22+
## Impact
23+
24+
### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml
25+
26+
- **Severity**: High 7.5
27+
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
28+
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
29+
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
30+
cvss_v3: 7.5
31+
patched_versions:
32+
- ">= 1.13.4"
33+
related:
34+
url:
35+
- https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
36+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6
37+
- https://nvd.nist.gov/vuln/detail/CVE-2022-24839
38+
- https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d
39+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
40+
- https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
41+
- https://github.com/advisories/GHSA-gx8x-g87m-h5q6

‎gems/nokogiri/GHSA-v6gp-9mmm-c6p5.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: nokogiri
3+
ghsa: v6gp-9mmm-c6p5
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
5+
title: Out-of-bounds Write in zlib affects Nokogiri
6+
date: 2022-04-11
7+
description: "## Summary\n\nNokogiri v1.13.4 updates the vendored zlib from 1.2.11
8+
to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032).
9+
That CVE is scored as CVSS 7.4 \"High\" on the NVD record as of 2022-04-05.\n\nPlease
10+
note that this advisory only applies to the CRuby implementation of Nokogiri `<
11+
1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this
12+
document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby)
13+
for a complete description of which platform gems vendor `zlib`. If you've overridden
14+
defaults at installation time to use system libraries instead of packaged libraries,
15+
you should instead pay attention to your distro's `zlib` release announcements.
16+
\n\n## Mitigation\n\nUpgrade to Nokogiri `>= v1.13.4`.\n\n## Impact\n\n### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032)
17+
in zlib\n\n- **Severity**: High\n- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html)
18+
Out of bounds write\n- **Description**: zlib before 1.2.12 allows memory corruption
19+
when deflating (i.e., when compressing) if the input has many distant matches.\n\n"
20+
cvss_v3: 7.5
21+
patched_versions:
22+
- ">= 1.13.4"
23+
related:
24+
url:
25+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
26+
- https://nvd.nist.gov/vuln/detail/CVE-2018-25032
27+
- https://github.com/advisories/GHSA-jc36-42cf-vqwj
28+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
29+
- https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
30+
- https://github.com/advisories/GHSA-v6gp-9mmm-c6p5

‎gems/nokogiri/GHSA-vcc3-rw6f-jv97.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
gem: nokogiri
3+
ghsa: vcc3-rw6f-jv97
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
5+
title: Use-after-free in libxml2 via Nokogiri::XML::Reader
6+
date: 2024-03-18
7+
description: |
8+
### Summary
9+
10+
Nokogiri upgrades its dependency libxml2 as follows:
11+
- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
12+
- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4
13+
14+
libxml2 v2.11.7 and v2.12.5 address the following vulnerability:
15+
16+
CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
17+
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
18+
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
19+
20+
Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
21+
the packaged libraries are being used. If you've overridden defaults at installation time to use
22+
system libraries instead of packaged libraries, you should instead pay attention to your distro's
23+
libxml2 release announcements.
24+
25+
JRuby users are not affected.
26+
27+
### Severity
28+
29+
The Nokogiri maintainers have evaluated this as **Moderate**.
30+
31+
### Impact
32+
33+
From the CVE description, this issue applies to the `xmlTextReader` module (which underlies
34+
`Nokogiri::XML::Reader`):
35+
36+
> When using the XML Reader interface with DTD validation and XInclude expansion enabled,
37+
> processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
38+
39+
### Mitigation
40+
41+
Upgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.
42+
43+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
44+
and link Nokogiri against patched external libxml2 libraries which will also address these same
45+
issues.
46+
cvss_v3: 7.5
47+
patched_versions:
48+
- "~> 1.15.6"
49+
- ">= 1.16.2"
50+
related:
51+
url:
52+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
53+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml
54+
- https://github.com/advisories/GHSA-vcc3-rw6f-jv97

‎gems/nokogiri/GHSA-xxx9-3xcr-gjj3.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
gem: nokogiri
3+
ghsa: xxx9-3xcr-gjj3
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3
5+
title: XML Injection in Xerces Java affects Nokogiri
6+
date: 2022-04-11
7+
description: |+
8+
## Summary
9+
10+
Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record.
11+
12+
Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.
13+
14+
## Mitigation
15+
16+
Upgrade to Nokogiri `>= v1.13.4`.
17+
18+
## Impact
19+
20+
### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J
21+
22+
- **Severity**: Medium
23+
- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
24+
- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
25+
- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
26+
27+
cvss_v3: 6.5
28+
patched_versions:
29+
- ">= 1.13.4"
30+
related:
31+
url:
32+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3
33+
- https://nvd.nist.gov/vuln/detail/CVE-2022-23437
34+
- https://github.com/advisories/GHSA-h65f-jvqw-m9fj
35+
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
36+
- https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
37+
- https://github.com/advisories/GHSA-xxx9-3xcr-gjj3

0 commit comments

Comments
 (0)