846623 – (CVE-2022-29181) <dev-ruby/nokogiri-1.13.6: illegal reads via crafted input

Bug 846623 (CVE-2022-29181) - <dev-ruby/nokogiri-1.13.6: illegal reads via crafted input

Summary: <dev-ruby/nokogiri-1.13.6: illegal reads via crafted input

Status:	RESOLVED FIXED

Alias:	CVE-2022-29181

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://github.com/sparklemotion/noko...
Whiteboard:	B4 [glsa+]
Keywords:

Depends on:	847127 847496
Blocks:
	Show dependency tree

Reported:	2022-05-20 23:52 UTC by John Helmert III
Modified:	2022-08-14 21:45 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-05-20 23:52:47 UTC

CVE-2022-29181 (https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6):

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

Please stabilize 1.13.6.

Comment 1 Hans de Graaff gentoo-dev

2022-05-21 09:50:04 UTC

This requires a stable libxml2 2.9.14.

Comment 2 Hans de Graaff gentoo-dev

2022-05-28 05:42:25 UTC

Cleanup done.

Comment 3 John Helmert III archtester

2022-05-29 15:04:06 UTC

Thanks!

Comment 4 John Helmert III archtester

2022-08-14 04:53:57 UTC

GLSA request filed

Comment 5 Larry the Git Cow gentoo-dev

2022-08-14 21:45:20 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=4615e1d23edb7c238657339624a79b0f373b7ce8

commit 4615e1d23edb7c238657339624a79b0f373b7ce8
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-14 21:44:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-14 21:45:14 +0000

    [ GLSA 202208-29 ] Nokogiri: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/762685
    Bug: https://bugs.gentoo.org/837902
    Bug: https://bugs.gentoo.org/846623
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-29.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

Comment 6 Sam James archtester

2022-08-14 21:45:30 UTC

GLSA done, all done.