RubyGems/nokogiri CVE-2022-23476: high 7.5, EPSS 1.82%

Unchecked return value from xmlTextReaderExpand

Action: Upgrade nokogiri to 1.13.10 or later.

bundle update nokogiri

Affected

Fixed versions

Sources

• osv: GHSA-qv4q-mr5r-qprj
• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
• https://nvd.nist.gov/vuln/detail/CVE-2022-23476
• https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
• https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml
• https://github.com/sparklemotion/nokogiri

CVE-2022-23476 · published 2022-12-08T03:03:33Z · modified 2023-11-08T04:08:18.808326Z · JSON