| Package | Affected versions | Patched versions |
|---|---|---|
| nokogiri | < 1.13.4 | 1.13.4 |
Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses CVE-2018-25032. That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.
Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.13.4, and only if the packaged version of zlib is being used. Please see this document for a complete description of which platform gems vendor zlib. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's zlib release announcements.
Upgrade to Nokogiri >= v1.13.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free