Vulnerability · Published Dec 8, 2022 · Assigned by GitHub_M
CVE-2022-23476Unchecked return value from xmlTextReaderExpand in Nokogiri
High 7.5
In plain English
A high-severity null pointer dereference in nokogiri from sparklemotion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | ruby-nokogiri | 1.13.10-r0 | ALPINE-CVE-2022-23476 |
| Alpine:v3.21 | ruby-nokogiri | 1.13.10-r0 | ALPINE-CVE-2022-23476 |
| Alpine:v3.22 | ruby-nokogiri | 1.13.10-r0 | ALPINE-CVE-2022-23476 |
| Alpine:v3.23 | ruby-nokogiri | 1.13.10-r0 | ALPINE-CVE-2022-23476 |
| Alpine:v3.24 | ruby-nokogiri | 1.13.10-r0 | ALPINE-CVE-2022-23476 |
| Debian:12 | ruby-nokogiri | 1.13.10+dfsg-1 | DEBIAN-CVE-2022-23476 |
| Debian:13 | ruby-nokogiri | 1.13.10+dfsg-1 | DEBIAN-CVE-2022-23476 |
| Debian:14 | ruby-nokogiri | 1.13.10+dfsg-1 | DEBIAN-CVE-2022-23476 |
| RubyGems | nokogiri | 1.13.10 | GHSA-qv4q-mr5r-qprj |
| Ubuntu:22.04:LTS | ruby-nokogiri | no fix listed | UBUNTU-CVE-2022-23476 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sparklemotion | nokogiri | >= 1.13.8, < 1.13.10 |
Weakness: CWE-252, CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj x_refsource_CONFIRM
- https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce x_refsource_MISC
- https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50 x_refsource_MISC