RubyGems/rexical CVE-2019-5477: critical 9.8, EPSS 5.90%
Nokogiri Command Injection Vulnerability
Action: Upgrade rexical to 1.0.7 or later.
bundle update rexicalAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.7 | - |
Fixed versions
| 1.0.7 |
Sources
- osv: GHSA-cr5j-953j-xw5p#RubyGems/rexical
- https://nvd.nist.gov/vuln/detail/CVE-2019-5477
- https://github.com/sparklemotion/nokogiri/issues/1915
- https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc
- https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926
- https://hackerone.com/reports/650835
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml
- https://github.com/sparklemotion/nokogiri
- https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc
- https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html
- https://security.gentoo.org/glsa/202006-05
- https://usn.ubuntu.com/4175-1
CVE-2019-5477 · published · modified · JSON