In breve
- CVE-2022-24836 è una vulnerabilità ALTO (CVSS 7.5) che riguarda nokogiri, nokogiri (nokogiri).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.5%, superiore al 89.2% delle vulnerabilità.
- Correzione: aggiornare a 1.13.4 o successiva.
| Package | Affected versions | Patched versions |
|---|
| nokogiri RubyGems | < 1.13.4
| 1.13.4
|
| nokogiri | < 1.13.4
| 1.13.4
|
Description
Summary
Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.
Mitigation
Upgrade to Nokogiri >= 1.13.4.
Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
CWE-1333 Inefficient Regular Expression Complexity
Credit
This vulnerability was reported by HackerOne user ooooooo_q (ななおく).
NVD description
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free