CVE-2022-24836
High
Description
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Nokogiri
PublishedApr 11, 2022
First seenApr 11, 2022
How to fix
Update
- nokogiri nokogiri1.13.4 or later
- apple macos13.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/
- security.gentoo.org/glsa/202208-29
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nokogiri nokogiri | v < 1.13.4 | 1.13.4 |
| fedoraproject fedora | 34, 35, 36 | — |
| debian debian_linux | 9.0, 10.0 | — |
| apple macos | 13.0 ≤ v < 13.1 | 13.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.