{"action":"Upgrade nokogiri to 1.10.8 or later.","affected":[{"fixed":"1.10.8","introduced":"0"}],"component":"nokogiri","cve_ids":["CVE-2020-7595"],"ecosystem":"RubyGems","epss":0.07836,"exploited":false,"fixed_versions":["1.10.8"],"ghsa_id":"GHSA-7553-jr98-vx47","id":"tcs_01M5KEHHYYEYV9NQWJE43YAK33","modified_at":"2024-03-08T05:17:10.482322Z","published_at":"2020-02-24T19:12:36Z","references":["https://osv.dev/vulnerability/GHSA-7553-jr98-vx47","https://nvd.nist.gov/vuln/detail/CVE-2020-7595","https://github.com/sparklemotion/nokogiri/issues/1992","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://usn.ubuntu.com/4274-1","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://security.netapp.com/advisory/ntap-20200702-0005","https://security.gentoo.org/glsa/202010-04","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","https://github.com/sparklemotion/nokogiri","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7553-jr98-vx47","url":"https://osv.dev/vulnerability/GHSA-7553-jr98-vx47"}],"summary":"libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation"}