Bug 846623 – <dev-ruby/nokogiri-1.13.6: illegal reads via crafted input

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-05-20 23:52:47 UTC]

CVE-2022-29181 (https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6):

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

Please stabilize 1.13.6.

[Comment 1 Hans de Graaff 2022-05-21 09:50:04 UTC]

This requires a stable libxml2 2.9.14.

[Comment 2 Hans de Graaff 2022-05-28 05:42:25 UTC]

Cleanup done.

[Comment 3 John Helmert III 2022-05-29 15:04:06 UTC]

Thanks!

[Comment 4 John Helmert III 2022-08-14 04:53:57 UTC]

GLSA request filed

[Comment 5 Larry the Git Cow 2022-08-14 21:45:20 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=4615e1d23edb7c238657339624a79b0f373b7ce8

commit 4615e1d23edb7c238657339624a79b0f373b7ce8
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-14 21:44:58 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-08-14 21:45:14 +0000

    [ GLSA 202208-29 ] Nokogiri: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/762685
    Bug: https://bugs.gentoo.org/837902
    Bug: https://bugs.gentoo.org/846623
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202208-29.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

[Comment 6 Sam James 2022-08-14 21:45:30 UTC]

GLSA done, all done.