Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12NmdwLTltbW0tYzZwNc054w

Out-of-bounds Write in zlib affects Nokogiri

Summary

Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses CVE-2018-25032. That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.

Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.13.4, and only if the packaged version of zlib is being used. Please see this document for a complete description of which platform gems vendor zlib. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's zlib release announcements.

Mitigation

Upgrade to Nokogiri >= v1.13.4.

Impact

CVE-2018-25032 in zlib

• Severity: High
• Type: CWE-787 Out of bounds write
• Description: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Permalink: https://github.com/advisories/GHSA-v6gp-9mmm-c6p5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NmdwLTltbW0tYzZwNc054w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: about 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-v6gp-9mmm-c6p5
References:

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
• https://nvd.nist.gov/vuln/detail/CVE-2018-25032
• https://github.com/advisories/GHSA-jc36-42cf-vqwj
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
• https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
• https://github.com/advisories/GHSA-v6gp-9mmm-c6p5

Repository: https://github.com/sparklemotion/nokogiri
Blast Radius: 45.3

Affected Packages