RubyGems/nokogiri CVE-2019-5477: critical 9.8, EPSS 5.90%

Nokogiri Command Injection Vulnerability

Action: Upgrade nokogiri to 1.10.4 or later.

bundle update nokogiri

Affected

Fixed versions

Sources

• osv: GHSA-cr5j-953j-xw5p
• https://nvd.nist.gov/vuln/detail/CVE-2019-5477
• https://github.com/sparklemotion/nokogiri/issues/1915
• https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc
• https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
• https://hackerone.com/reports/650835
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml
• https://github.com/sparklemotion/nokogiri
• https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc
• https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html
• https://security.gentoo.org/glsa/202006-05
• https://usn.ubuntu.com/4175-1

CVE-2019-5477 · published 2019-08-19T19:27:23Z · modified 2024-02-18T05:31:26.336802Z · JSON