Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 837902 (CVE-2022-24836) - <dev-ruby/nokogiri-1.13.4: ReDoS in HTML encoding detection
Summary: <dev-ruby/nokogiri-1.13.4: ReDoS in HTML encoding detection
Status: RESOLVED FIXED
Alias: CVE-2022-24836
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://github.com/sparklemotion/noko...
Whiteboard: B3 [glsa+]
Keywords:
Depends on: 838136
Blocks:
  Show dependency tree
 
Reported: 2022-04-12 01:36 UTC by John Helmert III
Modified: 2022-08-14 21:45 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-04-12 01:36:37 UTC 
CVE-2022-24836:

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Comment 1 Hans de Graaff gentoo-dev Security 2022-04-12 17:27:34 UTC 
commit 52308013eee310d812dea2668ebf3270bc5104fe
Author: Hans de Graaff <graaff@gentoo.org>
Date:   Tue Apr 12 07:41:16 2022 +0200

    dev-ruby/nokogiri: add 1.13.4
    
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>
Comment 2 Hans de Graaff gentoo-dev Security 2022-05-07 06:09:48 UTC 
Cleanup done.
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-10 15:59:28 UTC 
Thanks!
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-14 04:53:58 UTC 
GLSA request filed
Comment 5 Larry the Git Cow gentoo-dev 2022-08-14 21:45:21 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=4615e1d23edb7c238657339624a79b0f373b7ce8

commit 4615e1d23edb7c238657339624a79b0f373b7ce8
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-14 21:44:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-14 21:45:14 +0000

    [ GLSA 202208-29 ] Nokogiri: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/762685
    Bug: https://bugs.gentoo.org/837902
    Bug: https://bugs.gentoo.org/846623
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-29.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-08-14 21:45:36 UTC 
GLSA done, all done.