Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0ycnI1LThxMzctMnc3aM0V_Q

Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

Severity

The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.)

Impact

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default.

Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:

• Nokogiri::XML::SAX::Parser
• Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
• Nokogiri::XML::SAX::PushParser
• Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser

Mitigation

JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.

CRuby users are not affected.

Permalink: https://github.com/advisories/GHSA-2rr5-8q37-2w7h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ycnI1LThxMzctMnc3aM0V_Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 12 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-2rr5-8q37-2w7h, CVE-2021-41098
References:

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h
• https://nvd.nist.gov/vuln/detail/CVE-2021-41098
• https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml
• https://github.com/advisories/GHSA-2rr5-8q37-2w7h

Repository: https://github.com/sparklemotion/nokogiri
Blast Radius: 45.3

Affected Packages