~ / search / GHSA-qxcg-xjjg-66mj

GHSA-qxcg-xjjg-66mj

Nokogiri vulnerable to libxslt protection mechanism bypass

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-11068

Packages

EcosystemPackageAffectedFixed in
RubyGems nokogiri < 1.10.3 1.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

A dependency of Nokogiri, libxslt through 1.1.33 allows bypass of a protection mechanism because callers of `xsltCheckRead` and `xsltCheckWrite` permit access even upon receiving a `-1` error code. `xsltCheckRead` can return `-1` for a crafted URL that is not actually invalid and is subsequently loaded.

References

External links from the advisory. They lead to third-party sites.