RubyGems/nokogiri: medium 6.5

XML Injection in Xerces Java affects Nokogiri

Action: Upgrade nokogiri to 1.13.4 or later.

bundle update nokogiri

Affected

Fixed versions

Sources

• osv: GHSA-xxx9-3xcr-gjj3
• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3
• https://nvd.nist.gov/vuln/detail/CVE-2022-23437
• https://github.com/advisories/GHSA-h65f-jvqw-m9fj
• https://github.com/sparklemotion/nokogiri
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
• https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer

published 2022-04-11T21:30:00Z · modified 2024-12-05T05:38:49.092101Z · JSON