CVE-2022-29181
Description
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a String by calling #to_s or equivalent.
Risk Information
Base Score
8.2
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS Score
Exploitation Probability
5.756
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2022-29181 are fixed in Ruby-nokogiri 1.13.6 | Windows |
| Multiple Vulnerabilities are affected in IBM Aspera Shares 1.10.1 | Windows |
| Multiple vulnerabilities are fixed in Mac OS - Ventura 13.1 (Software Update) - AutoReboot | Mac |
| SUSE-SU-2022:4015-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) ruby2.5-rubygem-nokogiri-1.8.5-150000.3.9.1.x86_64.rpm | Linux |
| SUSE-SU-2022:4016-1(SUSE Linux Enterprise Module for Basesystem 15-SP4 ) ruby2.5-rubygem-nokogiri-1.8.5-150400.14.3.1.x86_64.rpm | Linux |
| Vulnerabilities CVE-2022-29181 are fixed in Ruby-nokogiri for Linux 1.13.6 | Linux |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-611601 | Mac OS - Ventura 13.7.7 (Software Update) (Auto Reboot)(Deployment-Only) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234