CVE-2019-5477 - Nokogiri Command Injection Vulnerability #1915

flavorjones · 2019-07-20T19:40:01Z

CVE-2019-5477 - Nokogiri Command Injection Vulnerability

This issue has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp (Katsuhiko YOSHIDA).

I'd like to thank HackerOne for providing a secure, responsible mechanism for reporting, and for providing their fantastic service to the Nokogiri maintainers.

Severity

Nokogiri maintainers have evaluated this as High (CVSS3 8.1)

Description

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

Affected Versions

Nokogiri < v1.10.4

Mitigation

Upgrade to Nokogiri v1.10.4, or avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file with untrusted user input.

Further Mitigating Actions Taken

This vulnerability could have been easily detected using Rubocop's Security cop, and so the Security cop has been introduced into the test suite. If for any reason Rubocop flags something as "insecure" in the future, that will fail the test suite and block release.

References

History of this public disclosure

2019-07-20T19:42+00:00: empty issue-of-record created, all information is embargoed
2019-08-11T19:28+00:00: embargo ends, full information made available

The text was updated successfully, but these errors were encountered:

flavorjones · 2019-08-10T22:04:00Z

Checklist:

push commits to v1.10.x branch
watch nokogiri-v1.10.x pipeline go green
release v1.10.4
update this issue with full details
apply those commits to master

related to #1915

which was raised by Rubocop's security filter related to #1915

related to #1915

flavorjones · 2019-08-11T19:33:39Z

v1.10.4 has been released addressing this vulnerability.

related to #1915

which was raised by Rubocop's security filter related to #1915

related to #1915

`bundle exec rake security` alerted us to a vulnerability in the Nokogiri library we use for XML and HTML parsing. This PR updates the library to a version that is not vulnerable to the disclosed CVE as per the directions presented by the maintainers (sparklemotion/nokogiri#1915). ```bash $> bundle exec rake security ... Updated ruby-advisory-db ruby-advisory-db: 384 advisories Looking for ~/Projects/caseflow/.security.yml bundle-audit check --ignore= Name: nokogiri Version: 1.10.3 Advisory: CVE-2019-5477 Criticality: Unknown URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 Vulnerabilities found! Failed. Security vulnerabilities were found. Find the dependency in Gemfile.lock, then specify a safe version of the dependency in the Gemfile (preferred) or snooze the CVE in .security.yml for a week. ```

sparklemotion/nokogiri#1915

greysteil · 2019-08-15T09:53:27Z

@flavorjones thanks for all your work on this and everything else you do.

I'm on the security team at GitHub these days, and noticed that this didn't come through to our advisory curation team via the NVD feed, even though you've got a CVE for it. It looks like that's because the CVE has been assigned but not published.

Would you mind prodding HackerOne to mark this as published, now that it's been publicly disclosed? We're also planning to make it easy to get CVEs through GitHub itself and have the publishing process for them automated, so hopefully we can help more here in future.

see sparklemotion/nokogiri#1915

reedloden · 2019-08-15T17:47:58Z

@greysteil We (HackerOne) submitted it to MITRE for publication this morning (we normally only do this once a week, unless specifically asked to do it sooner). Once they process it, should be all live.

sparklemotion/nokogiri#1915

A bunch of PRs in the crowbar-core are blocked due to a travis CI check: bundle-audit check --ignore ... This is due to a security embargo that was lifted and blocked by a version of nokogiri: Name: nokogiri Version: 1.9.1 Advisory: CVE-2019-5477 Criticality: Unknown URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 I asked about it in the rocketchat #cloud channel, and apparently Rick has looked into it and it seems we are unaffected by it as we don't use the version when building the RPM. I've also done a quick look through IBS and I can't see nokogiri as a build requirement for crowbar, crowbar-core or crowbar-openstack. Well it isn't even mentioned in any of the spec files. So raising this PR to add it to the ignore so we can unblock the crowbar-core PRs. Adding the SOC-9635, as its the patch of mine that is blocked on it, and so it passes travis CI. (cherry picked from commit 8400e28)

Name: nokogiri Version: 1.10.3 Advisory: CVE-2019-5477 Criticality: High URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4

Summary: We don't use nokogiri directly in our library, but it found its was into our Gemfile.lock. I'm bumping the version in the Gemfile.lock because the version it's calling for has a security vuln: sparklemotion/nokogiri#1915. When I tried setting up this library from a github clone, so I imagine others may be running into this and wasting time on it as well. Another solution here would just be to remove nokogiri from our Gemfile.lock entirely. I don't think we use it directly anywhere, and was just included in the lock because it happened to be in someone's environment at the time of the lock file creation. Reviewed By: joetam Differential Revision: D18046184 fbshipit-source-id: de6263bb24783988545a77cb67ee66c9697820de

119: [Security] Bump nokogiri from 1.10.3 to 1.10.5 r=michaelbaudino a=dependabot-preview[bot] Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.10.3 to 1.10.5. **This update includes security fixes.** <details> <summary>Vulnerabilities fixed</summary> *Sourced from The Ruby Advisory Database.* > **Nokogiri Command Injection Vulnerability** > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > Upgrade to Nokogiri v1.10.4, or avoid calling the undocumented method `Nokogiri::CSS::Tokenizer#load_file` with untrusted user input. > > Patched versions: >= 1.10.4 > Unaffected versions: none *Sourced from [The Ruby Advisory Database](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml).* > **Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file** > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows > commands to be executed in a subprocess by Ruby's `Kernel.open` method. > Processes are vulnerable only if the undocumented method > `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions > v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner > code for parsing CSS queries. The underlying vulnerability was addressed in > Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in > Nokogiri v1.10.4. > > Upgrade to Nokogiri v1.10.4, or avoid calling the undocumented method > `Nokogiri::CSS::Tokenizer#load_file` with untrusted user input. > > Patched versions: >= 1.10.4 > Unaffected versions: none </details> <details> <summary>Release notes</summary> *Sourced from [nokogiri's releases](https://github.com/sparklemotion/nokogiri/releases).* > ## 1.10.5 / 2019-10-31 > > ### Dependencies > > * [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10 > * [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34 > > > > ## 1.10.4 / 2019-08-11 > > ### Security > > #### Address CVE-2019-5477 ([#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915)) > > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > This CVE's public notice is [sparklemotion/nokogiri#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915) > </details> <details> <summary>Changelog</summary> *Sourced from [nokogiri's changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md).* > ## 1.10.5 / 2019-10-31 > > ### Dependencies > > * [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10 > * [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34 > > > ## 1.10.4 / 2019-08-11 > > ### Security > > #### Address CVE-2019-5477 ([#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915)) > > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > This CVE's public notice is [sparklemotion/nokogiri#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915) </details> <details> <summary>Commits</summary> - [`1bc2ff9`](sparklemotion/nokogiri@1bc2ff9) version bump to v1.10.5 - [`383c1f8`](sparklemotion/nokogiri@383c1f8) update CHANGELOG - [`43a1753`](sparklemotion/nokogiri@43a1753) dependency: update libxslt to 1.1.34 final - [`99d8a6b`](sparklemotion/nokogiri@99d8a6b) dependency: update libxml to 2.9.10 final - [`2a86496`](sparklemotion/nokogiri@2a86496) add suppressions for ruby 2.7 - [`dca794a`](sparklemotion/nokogiri@dca794a) update CHANGELOG with correct release date for v1.10.4 - [`077e010`](sparklemotion/nokogiri@077e010) update rake-compiler commands to install bundler - [`beb832e`](sparklemotion/nokogiri@beb832e) version bump to v1.10.4 - [`5d30128`](sparklemotion/nokogiri@5d30128) Merge branch '1915-css-tokenizer-load-file-vulnerability_v1.10.x' into v1.10.x - [`c86b5fc`](sparklemotion/nokogiri@c86b5fc) update CHANGELOG - Additional commits viewable in [compare view](sparklemotion/nokogiri@v1.10.3...v1.10.5) </details> <br /> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.10.3&new-version=1.10.5)](https://dependabot.com/compatibility-score.html?dependency-name=nokogiri&package-manager=bundler&previous-version=1.10.3&new-version=1.10.5) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) If all status checks pass Dependabot will automatically merge this pull request. [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

Summary: Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.8.0 to 1.10.5. <details> <summary>Release notes</summary> *Sourced from [nokogiri's releases](https://github.com/sparklemotion/nokogiri/releases).* > ## 1.10.5 / 2019-10-31 > > ### Dependencies > > * [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10 > * [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34 > > > > ## 1.10.4 / 2019-08-11 > > ### Security > > #### Address CVE-2019-5477 ([#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915)) > > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > This CVE's public notice is [sparklemotion/nokogiri#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915) > > > ## 1.10.3 / 2019-04-22 > > ### Security Notes > > [MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in [#1892](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1892). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt. > > ## 1.10.2 / 2019-03-24 > > ### Security > > * [MRI] Remove support from vendored libxml2 for future script macros. [#1871](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1871) > * [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1877) > > > ### Bug fixes > > * [JRuby] Fix node ownership in duplicated documents. [#1060](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1060) > * [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, [#1872](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1872)] (Thanks, [@adjam](https://github.com/adjam)!) > > > > ## 1.10.1 / 2019-01-13 > > ### Features > > * [MRI] During installation, handle Xcode 10's new library pathOS. [#1801, [#1851](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1851)] (Thanks, [@mlj](https://github.com/mlj) and [@deepj](https://github.com/deepj)!) > * Avoid unnecessary creation of `Proc`s in many methods. [#1776](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1776) (Thanks, [@chopraanmol1](https://github.com/chopraanmol1)!) > ></tr></table> ... (truncated) </details> <details> <summary>Changelog</summary> *Sourced from [nokogiri's changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md).* > ## 1.10.5 / 2019-10-31 > > ### Dependencies > > * [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10 > * [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34 > > > ## 1.10.4 / 2019-08-11 > > ### Security > > #### Address CVE-2019-5477 ([#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915)) > > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > This CVE's public notice is [sparklemotion/nokogiri#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915) > > > ## 1.10.3 / 2019-04-22 > > ### Security Notes > > [MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in [#1892](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1892). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt. > > > ## 1.10.2 / 2019-03-24 > > ### Security > > * [MRI] Remove support from vendored libxml2 for future script macros. [#1871](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1871) > * [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1877) > > > ### Bug fixes > > * [JRuby] Fix node ownership in duplicated documents. [#1060](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1060) > * [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, [#1872](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1872)] (Thanks, [@adjam](https://github.com/adjam)!) > > > ## 1.10.1 / 2019-01-13 > > ### Features > > * [MRI] During installation, handle Xcode 10's new library path. [#1801, [#1851](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1851)] (Thanks, [@mlj](https://github.com/mlj) and [@deepj](https://github.com/deepj)!) > * Avoid unnecessary creation of `Proc`s in many methods. [#1776](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1776) (Thanks, [@chopraanmol1](https://github.com/chopraanmol1)!) > > ></tr></table> ... (truncated) </details> <details> <summary>Commits</summary> - [`1bc2ff9`](sparklemotion/nokogiri@1bc2ff9) version bump to v1.10.5 - [`383c1f8`](sparklemotion/nokogiri@383c1f8) update CHANGELOG - [`43a1753`](sparklemotion/nokogiri@43a1753) dependency: update libxslt to 1.1.34 final - [`99d8a6b`](sparklemotion/nokogiri@99d8a6b) dependency: update libxml to 2.9.10 final - [`2a86496`](sparklemotion/nokogiri@2a86496) add suppressions for ruby 2.7 - [`dca794a`](sparklemotion/nokogiri@dca794a) update CHANGELOG with correct release date for v1.10.4 - [`077e010`](sparklemotion/nokogiri@077e010) update rake-compiler commands to install bundler - [`beb832e`](sparklemotion/nokogiri@beb832e) version bump to v1.10.4 - [`5d30128`](sparklemotion/nokogiri@5d30128) Merge branch '1915-css-tokenizer-load-file-vulnerability_v1.10.x' into v1.10.x - [`c86b5fc`](sparklemotion/nokogiri@c86b5fc) update CHANGELOG - Additional commits viewable in [compare view](sparklemotion/nokogiri@v1.8.0...v1.10.5) </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.8.0&new-version=1.10.5)](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `dependabot rebase` will rebase this PR - `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `dependabot merge` will merge this PR after your CI passes on it - `dependabot squash and merge` will squash and merge this PR after your CI passes on it - `dependabot cancel merge` will cancel a previously requested merge and block automerging - `dependabot reopen` will reopen this PR if it is closed - `dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/watchman/network/alerts). </details> Pull Request resolved: #757 Differential Revision: D18281040 Pulled By: wez fbshipit-source-id: d5bf78860f5bbdcc3b88ea12a6533511e4405938

refs: sparklemotion/nokogiri#1915

See sparklemotion/nokogiri#1915

* Update Nokogiri version for CVE-2019-5477 refs: sparklemotion/nokogiri#1915 * Fix build errors in Ruby 2.1 and 2.2

Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8166 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw Title: Ability to forge per-form CSRF tokens given a global CSRF token Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8164 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY Title: Possible Strong Parameters Bypass in ActionPack Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2020-15169 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc Title: Potential XSS vulnerability in Action View Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-8167 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0 Title: CSRF Vulnerability in rails-ujs Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5418 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q Title: File Content Disclosure in Action View Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-5267 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8 Title: Possible XSS vulnerability in ActionView Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5419 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI Title: Denial of Service Vulnerability in Action View Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1 Name: activejob Version: 5.1.4 Advisory: CVE-2018-16476 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw Title: Broken Access Control vulnerability in Active Job Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1 Name: activesupport Version: 5.1.4 Advisory: CVE-2020-8165 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: ffi Version: 1.9.18 Advisory: CVE-2018-1000201 Criticality: High URL: https://github.com/ffi/ffi/releases/tag/1.9.24 Title: ruby-ffi DDL loading issue on Windows OS Solution: upgrade to >= 1.9.24 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2019-11358 Criticality: Medium URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ Title: Prototype pollution attack through jQuery $.extend Solution: upgrade to >= 4.3.4 Name: loofah Version: 2.1.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: flavorjones/loofah#144 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.1 Name: loofah Version: 2.1.1 Advisory: CVE-2018-16468 Criticality: Medium URL: flavorjones/loofah#154 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.3 Name: loofah Version: 2.1.1 Advisory: CVE-2019-15587 Criticality: Medium URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: nokogiri Version: 1.8.1 Advisory: CVE-2017-15412 Criticality: Unknown URL: sparklemotion/nokogiri#1714 Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities Solution: upgrade to >= 1.8.2 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: sparklemotion/nokogiri#1746 Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS Solution: upgrade to >= 1.8.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-26247 Criticality: Low URL: GHSA-vr8q-g5c7-m54m Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability Solution: upgrade to >= 1.11.0.rc4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-14404 Criticality: Unknown URL: sparklemotion/nokogiri#1785 Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Solution: upgrade to >= 1.8.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-11068 Criticality: Unknown URL: sparklemotion/nokogiri#1892 Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability Solution: upgrade to >= 1.10.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-7595 Criticality: High URL: sparklemotion/nokogiri#1992 Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation Solution: upgrade to >= 1.10.8 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-5477 Criticality: Critical URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: rack Version: 2.0.8 Advisory: CVE-2020-8161 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA Title: Directory traversal in Rack::Directory app bundled with Rack Solution: upgrade to ~> 2.1.3, >= 2.2.0 Name: rack Version: 2.0.8 Advisory: CVE-2020-8184 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names Solution: upgrade to ~> 2.1.4, >= 2.2.3 Name: rails-html-sanitizer Version: 1.0.3 Advisory: CVE-2018-3741 Criticality: Unknown URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ Title: XSS vulnerability in rails-html-sanitizer Solution: upgrade to >= 1.0.4 Name: sprockets Version: 3.7.1 Advisory: CVE-2018-3760 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k Title: Path Traversal in Sprockets Solution: upgrade to >= 2.12.5, < 3.0.0, >= 3.7.2, < 4.0.0, >= 4.0.0.beta8

…VEs) It found the following 53 vulnerabilities: Name: actionpack Version: 5.1.4 Advisory: CVE-2021-22885 Criticality: High URL: https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI Title: Possible Information Disclosure / Unintended Method Execution in Action Pack Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8166 Criticality: Medium URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw Title: Ability to forge per-form CSRF tokens given a global CSRF token Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8164 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY Title: Possible Strong Parameters Bypass in ActionPack Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2021-22904 Criticality: High URL: https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ Title: Possible DoS Vulnerability in Action Controller Token Authentication Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2 Name: actionpack Version: 5.1.4 Advisory: CVE-2022-23633 Criticality: High URL: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ Title: Possible exposure of information vulnerability in Action Pack Solution: upgrade to ~> 5.2.6, >= 5.2.6.2, ~> 6.0.4, >= 6.0.4.6, ~> 6.1.4, >= 6.1.4.6, >= 7.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2020-15169 Criticality: Medium URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc Title: Potential XSS vulnerability in Action View Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-5267 Criticality: Medium URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8 Title: Possible XSS vulnerability in ActionView Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2020-8167 Criticality: Medium URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0 Title: CSRF Vulnerability in rails-ujs Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5419 Criticality: High URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI Title: Denial of Service Vulnerability in Action View Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5418 Criticality: High URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q Title: File Content Disclosure in Action View Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3 Name: activejob Version: 5.1.4 Advisory: CVE-2018-16476 Criticality: High URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw Title: Broken Access Control vulnerability in Active Job Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1 Name: activerecord Version: 5.1.4 Advisory: CVE-2021-22880 Criticality: Medium URL: https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI Title: Possible DoS Vulnerability in Active Record PostgreSQL adapter Solution: upgrade to ~> 5.2.4, >= 5.2.4.5, ~> 6.0.3, >= 6.0.3.5, >= 6.1.2.1 Name: activesupport Version: 5.1.4 Advisory: CVE-2020-8165 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: addressable Version: 2.5.2 Advisory: CVE-2021-32740 Criticality: High URL: GHSA-jxhc-q857-3j6g Title: Regular Expression Denial of Service in Addressable templates Solution: upgrade to >= 2.8.0 Name: carrierwave Version: 1.2.1 Advisory: CVE-2021-21288 Criticality: Medium URL: GHSA-fwcm-636p-68r5 Title: Server-side request forgery in CarrierWave Solution: upgrade to ~> 1.3.2, >= 2.1.1 Name: carrierwave Version: 1.2.1 Advisory: CVE-2021-21305 Criticality: High URL: GHSA-cf3w-g86h-35x4 Title: Code Injection vulnerability in CarrierWave::RMagick Solution: upgrade to ~> 1.3.2, >= 2.1.1 Name: ffi Version: 1.9.18 Advisory: CVE-2018-1000201 Criticality: High URL: https://github.com/ffi/ffi/releases/tag/1.9.24 Title: ruby-ffi DDL loading issue on Windows OS Solution: upgrade to >= 1.9.24 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2020-11023 Criticality: Medium URL: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released Title: Potential XSS vulnerability in jQuery Solution: upgrade to >= 4.4.0 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2019-11358 Criticality: Medium URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ Title: Prototype pollution attack through jQuery $.extend Solution: upgrade to >= 4.3.4 Name: jquery-ui-rails Version: 5.0.5 Advisory: CVE-2016-7103 Criticality: Medium URL: jquery/api.jqueryui.com#281 Title: XSS Vulnerability on closeText option of Dialog jQuery UI Solution: upgrade to >= 6.0.0 Name: kaminari Version: 1.1.1 Advisory: CVE-2020-11082 Criticality: Medium URL: GHSA-r5jw-62xg-j433 Title: Cross-Site Scripting in Kaminari via `original_script_name` parameter Solution: upgrade to >= 1.2.1 Name: loofah Version: 2.1.1 Advisory: CVE-2019-15587 Criticality: Medium URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: loofah Version: 2.1.1 Advisory: CVE-2018-16468 Criticality: Medium URL: flavorjones/loofah#154 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.3 Name: loofah Version: 2.1.1 Advisory: CVE-2018-8048 Criticality: Medium URL: flavorjones/loofah#144 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.1 Name: mini_magick Version: 4.8.0 Advisory: CVE-2019-13574 Criticality: High URL: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/ Title: Remote command execution via filename Solution: upgrade to >= 4.9.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-5477 Criticality: Critical URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2021-41098 Criticality: High URL: GHSA-2rr5-8q37-2w7h Title: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby Solution: upgrade to >= 1.12.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-11068 Criticality: Unknown URL: sparklemotion/nokogiri#1892 Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability Solution: upgrade to >= 1.10.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-14404 Criticality: High URL: sparklemotion/nokogiri#1785 Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Solution: upgrade to >= 1.8.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2017-15412 Criticality: Unknown URL: sparklemotion/nokogiri#1714 Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities Solution: upgrade to >= 1.8.2 Name: nokogiri Version: 1.8.1 Advisory: CVE-2022-24839 Criticality: High URL: GHSA-9849-p7jc-9rmv Title: Denial of Service (DoS) in Nokogiri on JRuby Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2022-23437 Criticality: Medium URL: GHSA-xxx9-3xcr-gjj3 Title: XML Injection in Xerces Java affects Nokogiri Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2021-30560 Criticality: High URL: GHSA-fq42-c5rg-92c2 Title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35) Solution: upgrade to >= 1.13.2 Name: nokogiri Version: 1.8.1 Advisory: GHSA-7rrm-v45f-jp64 Criticality: High URL: GHSA-7rrm-v45f-jp64 Title: Update packaged dependency libxml2 from 2.9.10 to 2.9.12 Solution: upgrade to >= 1.11.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-25032 Criticality: High URL: GHSA-v6gp-9mmm-c6p5 Title: Out-of-bounds Write in zlib affects Nokogiri Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: sparklemotion/nokogiri#1746 Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS Solution: upgrade to >= 1.8.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-7595 Criticality: High URL: sparklemotion/nokogiri#1992 Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation Solution: upgrade to >= 1.10.8 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2022-24836 Criticality: High URL: GHSA-crjr-9rc5-ghw8 Title: Inefficient Regular Expression Complexity in Nokogiri Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-26247 Criticality: Low URL: GHSA-vr8q-g5c7-m54m Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability Solution: upgrade to >= 1.11.0.rc4 Name: puma Version: 4.3.3 Advisory: CVE-2021-29509 Criticality: High URL: GHSA-q28m-8xjw-8vr5 Title: Keepalive Connections Causing Denial Of Service in puma Solution: upgrade to ~> 4.3.8, >= 5.3.1 Name: puma Version: 4.3.3 Advisory: CVE-2022-24790 Criticality: Critical URL: GHSA-h99w-9q5r-gjq9 Title: HTTP Request Smuggling in puma Solution: upgrade to ~> 4.3.12, >= 5.6.4 Name: puma Version: 4.3.3 Advisory: CVE-2020-11076 Criticality: High URL: GHSA-x7jg-6pwg-fx5h Title: HTTP Smuggling via Transfer-Encoding Header in Puma Solution: upgrade to ~> 3.12.5, >= 4.3.4 Name: puma Version: 4.3.3 Advisory: CVE-2020-11077 Criticality: Medium URL: GHSA-w64w-qqph-5gxm Title: HTTP Smuggling via Transfer-Encoding Header in Puma Solution: upgrade to ~> 3.12.6, >= 4.3.5 Name: puma Version: 4.3.3 Advisory: CVE-2022-23634 Criticality: High URL: GHSA-rmj8-8hhh-gv5h Title: Information Exposure with Puma when used with Rails Solution: upgrade to ~> 4.3.11, >= 5.6.2 Name: puma Version: 4.3.3 Advisory: CVE-2021-41136 Criticality: Low URL: GHSA-48w2-rm65-62xx Title: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma Solution: upgrade to ~> 4.3.9, >= 5.5.1 Name: rack Version: 2.2.2 Advisory: CVE-2020-8184 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names Solution: upgrade to ~> 2.1.4, >= 2.2.3 Name: rails-html-sanitizer Version: 1.0.3 Advisory: CVE-2018-3741 Criticality: Unknown URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ Title: XSS vulnerability in rails-html-sanitizer Solution: upgrade to >= 1.0.4 Name: rails_admin Version: 1.2.0 Advisory: CVE-2020-36190 Criticality: Medium URL: railsadminteam/rails_admin@d72090e Title: rails_admin ruby gem XSS vulnerability Solution: upgrade to ~> 1.4.3, >= 2.0.2 Name: rails_admin Version: 1.2.0 Advisory: CVE-2017-12098 Criticality: Medium URL: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450 Title: rails_admin ruby gem XSS vulnerability Solution: upgrade to >= 1.3.0 Name: rake Version: 12.3.0 Advisory: CVE-2020-8130 Criticality: High URL: GHSA-jppv-gw3r-w3q8 Title: OS Command Injection in Rake Solution: upgrade to >= 12.3.3 Name: redcarpet Version: 3.4.0 Advisory: CVE-2020-26298 Criticality: Medium URL: vmg/redcarpet@a699c82 Title: Injection/XSS in Redcarpet Solution: upgrade to >= 3.5.1 Name: websocket-extensions Version: 0.1.3 Advisory: CVE-2020-7663 Criticality: High URL: GHSA-g6wq-qcwm-j5g2 Title: Regular Expression Denial of Service in websocket-extensions (RubyGem) Solution: upgrade to >= 0.1.5

flavorjones added the topic/security label Aug 6, 2019

flavorjones added this to the v1.10.x patch releases milestone Aug 10, 2019

flavorjones added a commit that referenced this issue Aug 11, 2019

add rubocop as a dev dependency

d068cd4

related to #1915

flavorjones added a commit that referenced this issue Aug 11, 2019

eliminate eval from Builder#initialize

6777008

which was raised by Rubocop's security filter related to #1915

flavorjones added a commit that referenced this issue Aug 11, 2019

regenerate lexical scanner using rexical 1.0.7

5fe449f

related to #1915

flavorjones added a commit that referenced this issue Aug 11, 2019

update CHANGELOG

c86b5fc

related to #1915

flavorjones closed this as completed Aug 11, 2019

flavorjones added a commit that referenced this issue Aug 11, 2019

add rubocop as a dev dependency

5f82689

related to #1915

flavorjones added a commit that referenced this issue Aug 11, 2019

eliminate eval from Builder#initialize

daffe22

which was raised by Rubocop's security filter related to #1915

flavorjones added a commit that referenced this issue Aug 11, 2019

regenerate lexical scanner using rexical 1.0.7

6aa10f5

related to #1915

flavorjones added a commit that referenced this issue Aug 11, 2019

update CHANGELOG

3e98720

related to #1915

flavorjones changed the title ~~[placeholder] embargoed security vulnerability~~ CVE-2019-5477 - Nokogiri Command Injection Vulnerability Aug 11, 2019

touhouota mentioned this issue Aug 12, 2019

bundle update touhouota/RTS_old#11

Merged

cantino mentioned this issue Aug 12, 2019

Upgrade nokogiri to 1.10.4 for CVE-2019-5477 huginn/huginn#2582

Merged

lowellrex mentioned this issue Aug 13, 2019

Update Nokogiri to protect against CVE-2019-5477 department-of-veterans-affairs/caseflow#11751

Merged

peerkleio mentioned this issue Aug 13, 2019

Bumps nokogiri for CVE-2019-5477 Shopify/shipit-engine#932

Merged

dentarg added a commit to twingly/feedbag.herokuapp.com that referenced this issue Aug 14, 2019

Update Nokogiri (CVE-2019-5477)

1126658

sparklemotion/nokogiri#1915

dentarg added a commit to twingly/feedjira.herokuapp.com that referenced this issue Aug 14, 2019

Update Nokogiri (CVE-2019-5477)

f08de48

sparklemotion/nokogiri#1915

phallstrom added a commit to railslink/railslink that referenced this issue Aug 15, 2019

upgrade nokogiri for CVE-2019-5477

e8d2af1

see sparklemotion/nokogiri#1915

phallstrom mentioned this issue Aug 15, 2019

upgrade nokogiri for CVE-2019-5477 railslink/railslink#106

Merged

phallstrom added a commit to railslink/railslink that referenced this issue Aug 15, 2019

upgrade nokogiri for CVE-2019-5477

88b0639

see sparklemotion/nokogiri#1915

phallstrom added a commit to railslink/railslink that referenced this issue Aug 15, 2019

upgrade nokogiri for CVE-2019-5477 (#106)

b9acc9e

see sparklemotion/nokogiri#1915

arku mentioned this issue Aug 15, 2019

Upgrade Nokogiri TheOdinProject/theodinproject#1019

Merged

touhouota mentioned this issue Aug 17, 2019

bundle update touhouota/RTS_old#12

Merged

isay-sosa added a commit to isay-sosa/machetito that referenced this issue Aug 19, 2019

Update nokogiri due to vulnerability

2cb65a4

sparklemotion/nokogiri#1915

rhafer mentioned this issue Aug 30, 2019

[5.0] Add CVE-2019-5477 the to travis ignore list (SOC-9635) crowbar/crowbar-core#1910

Merged

rhafer mentioned this issue Aug 30, 2019

[4.0] Add CVE-2019-5477 the to travis ignore list (SOC-9635) crowbar/crowbar-core#1911

Merged

ghardytest bot mentioned this issue Aug 30, 2019

Vulnerabilities found in nokogiri 1.8.0 Contrast-Security-OSS/ghardy-test#600

Open

vbalbarin mentioned this issue Oct 2, 2019

Patching for CVE-2019-5477 YaleSpinup/dns-api#2

Merged

pdobb mentioned this issue Oct 24, 2019

Add a gem w/ a known security vulnerability pdobb/pronto-bundler_audit_test_app#1

Merged

typeoneerror mentioned this issue Nov 11, 2019

Relax versioning on rubyzip and nokogiri zendesk/zendesk_apps_tools#322

Open

sinsoku added a commit to sinsoku/wovnrb that referenced this issue Nov 30, 2019

Update Nokogiri version for CVE-2019-5477

445416c

refs: sparklemotion/nokogiri#1915

sinsoku mentioned this issue Nov 30, 2019

Update Nokogiri version for CVE-2019-5477 WOVNio/wovnrb#154

Merged

d-leclere added a commit to d-leclere/github-slideshow that referenced this issue Dec 10, 2019

Update Gemfile.lock

6e08b74

See sparklemotion/nokogiri#1915

d-leclere added a commit to d-leclere/github-slideshow that referenced this issue Dec 10, 2019

Update Gemfile.lock

1e40650

See sparklemotion/nokogiri#1915

bstewart00 pushed a commit to WOVNio/wovnrb that referenced this issue Dec 11, 2019

Update Nokogiri version for CVE-2019-5477 (#154)

b0cfe4e

* Update Nokogiri version for CVE-2019-5477 refs: sparklemotion/nokogiri#1915 * Fix build errors in Ruby 2.1 and 2.2

This was referenced Dec 18, 2019

Bump Nokogiri version Azure/azure-ruby-asm-core#69

Closed

Bump Nokogiri version Azure/azure-storage-ruby#149

Closed

annavyral mentioned this issue Feb 11, 2020

Bump nokogiri from 1.8.5 to 1.10.8 Vyral/jp-fluellen-recruiting#4

Closed

lbiedma mentioned this issue Feb 12, 2020

Bump nokogiri from 1.8.2 to 1.10.5 crscardellino/crscardellino.github.io#1

Closed

ColinDKelley mentioned this issue Apr 30, 2020

gem version requirements notation for "rational version" compatibility rubygems/rubygems#3574

Open

AdrianCann mentioned this issue Oct 10, 2020

Update gems to fix all the CVEs sophomoric/secret#96

Merged

flavorjones mentioned this issue Jan 23, 2021

Tidy the project, and prepare for another release. sparklemotion/mechanize#560

Closed

10 tasks

github-actions bot mentioned this issue Jun 3, 2021

Security Alert Test lazy-actions/gitrivy#99

Closed

kares mentioned this issue Feb 17, 2022

Logstash Package with 2.6+ Ruby elastic/logstash#13704

Closed

tdunlap607 mentioned this issue Apr 2, 2023

[GHSA-cr5j-953j-xw5p] Arbitrary execution of code in Nokogiri github/advisory-database#1932

Merged

willmurphyscode mentioned this issue Jun 6, 2023

false positives in logstash image anchore/grype#816

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2019-5477 - Nokogiri Command Injection Vulnerability #1915

CVE-2019-5477 - Nokogiri Command Injection Vulnerability #1915

flavorjones commented Jul 20, 2019 •

edited

Loading

flavorjones commented Aug 10, 2019 •

edited

Loading

flavorjones commented Aug 11, 2019

greysteil commented Aug 15, 2019

reedloden commented Aug 15, 2019

CVE-2019-5477 - Nokogiri Command Injection Vulnerability #1915

CVE-2019-5477 - Nokogiri Command Injection Vulnerability #1915

Comments

flavorjones commented Jul 20, 2019 • edited Loading

CVE-2019-5477 - Nokogiri Command Injection Vulnerability

Severity

Description

Affected Versions

Mitigation

Further Mitigating Actions Taken

References

History of this public disclosure

flavorjones commented Aug 10, 2019 • edited Loading

flavorjones commented Aug 11, 2019

greysteil commented Aug 15, 2019

reedloden commented Aug 15, 2019

flavorjones commented Jul 20, 2019 •

edited

Loading

flavorjones commented Aug 10, 2019 •

edited

Loading