Investigate libxslt vulnerabilities patched in USN-4164-1 #1943

flavorjones · 2019-11-17T17:57:50Z

This issue is to drive investigation and potential action around a set of upstream patches that Canonical judged valuable enough to port to their distributions.

References:

Summary (2019-11-17)

These vulnerabilities are patched in libxslt v1.1.34 which is vendored in Nokogiri v1.10.5 and later.

Present in: Nokogiri <= v1.10.4

Advisory: upgrade to Nokogiri v1.10.5 or later

History of this notification:

2019-10-22: USN-4164-1 published by Canonical
2019-10-31: v1.10.5 released as a maintenance update
2019-11-06: email notification to maintainer about the USN
2019-11-17: this github issue created
2019-11-17: analysis, advice, and security noitifcations posted

flavorjones · 2019-11-17T17:58:53Z

CVE-2019-13117

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
could allow an attacker to discern whether a byte on the stack contains the
characters A, a, I, i, or 0, or any other character.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1

This patch is present in libxslt 1.1.34:

libxslt $ git tag --contains c5eb6cf3aba0af048596106ed839b4ae17ecbcb1
v1.1.34
v1.1.34-rc2

flavorjones · 2019-11-17T17:59:38Z

CVE-2019-13118

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
xsl:number instruction was too narrow and an invalid character/length
combination could be passed to xsltNumberFormatDecimal, leading to a read
of uninitialized stack data

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b

This patch is present in libxslt 1.1.34:

libxslt $ git tag --contains 6ce8de69330783977dd14f6569419489875fb71b
v1.1.34
v1.1.34-rc2

flavorjones · 2019-11-17T18:00:26Z

CVE-2019-18197

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html

Priority: Medium

Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
reset under certain circumstances. If the relevant memory area happened to
be freed and reused in a certain way, a bounds check could fail and memory
outside a buffer could be written to, or uninitialized data could be
disclosed.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285

This patch is present in libxslt 1.1.34:

libxslt $ git tag --contains 2232473733b7313d67de8836ea3b29eec6e8e285
v1.1.34
v1.1.34-rc2

flavorjones · 2019-11-17T18:03:07Z

Summary

All three CVEs are patched in libxslt 1.1.34, and so these CVEs are addressed in v1.10.5 courtesy of commit 43a1753

Actions

update changelog to indicate security aspects of the version
update nokogiri.org changelog
update Tidelift changelog
notify mailing lists: email nokogiri-talk, ruby-talk, ruby-security-ann@googlegroups.com, oss-security@lists.openwall.com

related to #1943

This also updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943

This updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943

Resolves a security warning: ``` Name: nokogiri Version: 1.10.4 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 ``` ### Description Upgrades `nokogiri` to 1.10.5, which updates the included `libxml` dependency that contained a couple of vulnerabilities. I wouldn't expect any breakages See: sparklemotion/nokogiri#1943

…ages Fixed vulnerability: sparklemotion/nokogiri#1943

sparklemotion/nokogiri#1943

See sparklemotion/nokogiri#1943

This update is due to CVE-2019-13117, sparklemotion/nokogiri#1943 "Nokogiri gem, via libxslt, is affected by multiple vulnerabilities". At first blush it doesn't look like these are exploitable in our applications, but it's hard to be certain of that. Much better to just upgrade. Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>

```yaml Name: nokogiri Version: 1.10.4 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 ```

Name: nokogiri Version: 1.10.4 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5

Name: loofah Version: 2.2.3 Advisory: CVE-2019-15587 Criticality: Unknown URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: nokogiri Version: 1.10.4 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: puma Version: 3.12.1 Advisory: CVE-2019-16770 Criticality: High URL: GHSA-7xx3-m584-x994 Title: Keepalive thread overload/DoS in puma Solution: upgrade to ~> 3.12.2, >= 4.3.1

This also updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943 (cherry picked from commit 46ed8ed)

This updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943 (cherry picked from commit ad13058)

This updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943 (cherry picked from commit 55f4feb)

This also updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943 (cherry picked from commit 46ed8ed)

* Fixed SDC loading to work with newer DRC measures. And cherry-pick work from master. (#39) * Fixed SDC loading to work with newer DRC measures. - Fixed issues with most data criteria getting thrown out. * Bring over dependabot nokogiri update and the simplexml_parser removal from #30. [Security] Update nokogiri requirement from ~> 1.8.5 to >= 1.8.5, < 1.11.0 Updates the requirements on [nokogiri](https://github.com/sparklemotion/nokogiri) to permit the latest version. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.8.5...v1.10.3) * Add the hqmf identifier to a statement reference (#25) * Port ratio/proportional cv fix from hds and add tests (#48) * codeListId and hqmfOid are both needed for sdc uniqueness * Add descriptive error message if model cannot be found * 2019 standards update (#63) * 2019 standards update entry point fix (#54) * fixed gem entry point file to be named properly * fix issue with loading api uploaded files (#55) * [Security] Bump nokogiri from 1.10.3 to 1.10.4 * Bump cqm-models version to 3.0.0 * [Security] Update rubyzip requirement from ~> 1.2.2 to >= 1.2.2, < 2.1.0 (#67) * [Security] Update rubyzip requirement from ~> 1.2.2 to >= 1.2.2, < 2.1.0 Updates the requirements on [rubyzip](https://github.com/rubyzip/rubyzip) to permit the latest version. - [Release notes](https://github.com/rubyzip/rubyzip/releases) - [Changelog](https://github.com/rubyzip/rubyzip/blob/master/Changelog.md) - [Commits](rubyzip/rubyzip@v1.2.3...v2.0.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Updated rubyzip dependency to be less than version 2.x, which requires ruby 2.4 * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages * Bonnie-593(ONCJira) test case fix * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages Fixed vulnerability: sparklemotion/nokogiri#1943 * BONNIE-587 Error loading VSAC value sets(ONC jira id) * Updated version of bonnie_version cqm-parser branch (#71) * Updated version of bonnie_version cqm-parser branch * Updated cqm-parser (binnie_viersion branch) * Remove unnecessary fixtures and re-include test_5_4_CQL_measure_with_drc Co-authored-by: hossenlopp <hossenlopp@mitre.org> Co-authored-by: Luke Osborne <luke.w.osborne@gmail.com> Co-authored-by: dczulada <dczulada@users.noreply.github.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Ashok Dongare <ashok.dongare@semanticbits.com>

This updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943 (cherry picked from commit 55f4feb)

Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8166 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw Title: Ability to forge per-form CSRF tokens given a global CSRF token Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8164 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY Title: Possible Strong Parameters Bypass in ActionPack Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2020-15169 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc Title: Potential XSS vulnerability in Action View Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-8167 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0 Title: CSRF Vulnerability in rails-ujs Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5418 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q Title: File Content Disclosure in Action View Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-5267 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8 Title: Possible XSS vulnerability in ActionView Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5419 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI Title: Denial of Service Vulnerability in Action View Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1 Name: activejob Version: 5.1.4 Advisory: CVE-2018-16476 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw Title: Broken Access Control vulnerability in Active Job Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1 Name: activesupport Version: 5.1.4 Advisory: CVE-2020-8165 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: ffi Version: 1.9.18 Advisory: CVE-2018-1000201 Criticality: High URL: https://github.com/ffi/ffi/releases/tag/1.9.24 Title: ruby-ffi DDL loading issue on Windows OS Solution: upgrade to >= 1.9.24 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2019-11358 Criticality: Medium URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ Title: Prototype pollution attack through jQuery $.extend Solution: upgrade to >= 4.3.4 Name: loofah Version: 2.1.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: flavorjones/loofah#144 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.1 Name: loofah Version: 2.1.1 Advisory: CVE-2018-16468 Criticality: Medium URL: flavorjones/loofah#154 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.3 Name: loofah Version: 2.1.1 Advisory: CVE-2019-15587 Criticality: Medium URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: nokogiri Version: 1.8.1 Advisory: CVE-2017-15412 Criticality: Unknown URL: sparklemotion/nokogiri#1714 Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities Solution: upgrade to >= 1.8.2 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: sparklemotion/nokogiri#1746 Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS Solution: upgrade to >= 1.8.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-26247 Criticality: Low URL: GHSA-vr8q-g5c7-m54m Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability Solution: upgrade to >= 1.11.0.rc4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-14404 Criticality: Unknown URL: sparklemotion/nokogiri#1785 Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Solution: upgrade to >= 1.8.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-11068 Criticality: Unknown URL: sparklemotion/nokogiri#1892 Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability Solution: upgrade to >= 1.10.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-7595 Criticality: High URL: sparklemotion/nokogiri#1992 Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation Solution: upgrade to >= 1.10.8 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-5477 Criticality: Critical URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: rack Version: 2.0.8 Advisory: CVE-2020-8161 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA Title: Directory traversal in Rack::Directory app bundled with Rack Solution: upgrade to ~> 2.1.3, >= 2.2.0 Name: rack Version: 2.0.8 Advisory: CVE-2020-8184 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names Solution: upgrade to ~> 2.1.4, >= 2.2.3 Name: rails-html-sanitizer Version: 1.0.3 Advisory: CVE-2018-3741 Criticality: Unknown URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ Title: XSS vulnerability in rails-html-sanitizer Solution: upgrade to >= 1.0.4 Name: sprockets Version: 3.7.1 Advisory: CVE-2018-3760 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k Title: Path Traversal in Sprockets Solution: upgrade to >= 2.12.5, < 3.0.0, >= 3.7.2, < 4.0.0, >= 4.0.0.beta8

* Fixed SDC loading to work with newer DRC measures. And cherry-pick work from master. (#39) * Fixed SDC loading to work with newer DRC measures. - Fixed issues with most data criteria getting thrown out. * Bring over dependabot nokogiri update and the simplexml_parser removal from #30. [Security] Update nokogiri requirement from ~> 1.8.5 to >= 1.8.5, < 1.11.0 Updates the requirements on [nokogiri](https://github.com/sparklemotion/nokogiri) to permit the latest version. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.8.5...v1.10.3) * Add the hqmf identifier to a statement reference (#25) * Port ratio/proportional cv fix from hds and add tests (#48) * codeListId and hqmfOid are both needed for sdc uniqueness * Add descriptive error message if model cannot be found * 2019 standards update (#63) * 2019 standards update entry point fix (#54) * fixed gem entry point file to be named properly * fix issue with loading api uploaded files (#55) * [Security] Bump nokogiri from 1.10.3 to 1.10.4 * Bump cqm-models version to 3.0.0 * [Security] Update rubyzip requirement from ~> 1.2.2 to >= 1.2.2, < 2.1.0 (#67) * [Security] Update rubyzip requirement from ~> 1.2.2 to >= 1.2.2, < 2.1.0 Updates the requirements on [rubyzip](https://github.com/rubyzip/rubyzip) to permit the latest version. - [Release notes](https://github.com/rubyzip/rubyzip/releases) - [Changelog](https://github.com/rubyzip/rubyzip/blob/master/Changelog.md) - [Commits](rubyzip/rubyzip@v1.2.3...v2.0.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Updated rubyzip dependency to be less than version 2.x, which requires ruby 2.4 * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages * Bonnie-593(ONCJira) test case fix * BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Packages Fixed vulnerability: sparklemotion/nokogiri#1943 * BONNIE-587 Error loading VSAC value sets(ONC jira id) * Updated version of bonnie_version cqm-parser branch (#71) * Updated version of bonnie_version cqm-parser branch * Updated cqm-parser (binnie_viersion branch) * BONNIEMAT-614 Bonnie only processing one of two measure observations(oncjira) * [Security] Bump nokogiri from 1.10.5 to 1.10.8 (#76) Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.10.5 to 1.10.8. **This update includes a security fix.** - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.10.5...v1.10.8) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * [Security] Bump rake from 12.3.1 to 12.3.3 (#77) Bumps [rake](https://github.com/ruby/rake) from 12.3.1 to 12.3.3. **This update includes a security fix.** - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](ruby/rake@v12.3.1...v12.3.3) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> * MAT1385_rails_upgrade_bv (#87) * made necessary upgrades to line up with bonnie's rails upgrade -> 5.2 * removed deprecated require * updated codecov (0.1.14 -> 0.2.5) and json (2.1.0 -> 2.3.1) to fix 'Title: json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix)' * MAT-1308_update_cqm_models (#107) * cqm-models 3.0.0 -> 3.0.3 * ran bundle install * Mat 1708 (#112) * BONNIEMAT-623 & BONNIEMAT-629 cql-integration change * cqm-models version upgrade * [MAT-1757] Replacing VSAC Username/Password with API Key in VSAC Calls (#114) * Replacing vsac username/password with api key. * Checking for nil via safe navigation on single_code_concepts hash before checking sub-hash. When QDM datatype template has includeSubTemplate, the single_code_concepts hash will not have a related key to access the sub-hash. * Replacing safe nav operator with Hash.dig to better handle the nested hashes. * pull in cqm-model v3.0.6 version (#129) * MAT-2803 (#143) * MAT-2803 Update Bonnie to support UTF8 - QDM * Ruby 2.7.2 warnings fix * MAT-2647 Update cqm-parsers to QDM 5.6 (#148) * MAT-2647 Update cqm-parsers to QDM 5.6 * MAT-2647 Update cqm-parsers to QDM 5.6 * added git actions * removed travis.yaml * Integrate from cqm-models MAT-2993 Failed to initialize Data element with class attribute in Bonnie (#149) * ecurity vulnerabilty nokogiry (#150) * MAT-2837: Using published version of cqm-models (v4.0.0) instead of branch * bump nokogiri in case of security vulnerability * Baseline for v4.0.0 release * update Gemfile * git ignore Gemfile.lock * move ci workflow and add gitleaks.toml * address rubocop concerns * revert activesupport to support rails 5 * Bring mongoid back to 6 Co-authored-by: hossenlopp <hossenlopp@mitre.org> Co-authored-by: Luke Osborne <lwosborne@mitre.org> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Ashok <ashok.dongare@semanticbits.com> Co-authored-by: Daniel Mee <danmee10@gmail.com> Co-authored-by: Joe Kotanchik <56264529+jkotanchik-SB@users.noreply.github.com> Co-authored-by: Joe Kotanchik <joseph.kotanchik@semanticbits.com> Co-authored-by: Andrew Bird <andrew.bird@semanticbits.com>

…VEs) It found the following 53 vulnerabilities: Name: actionpack Version: 5.1.4 Advisory: CVE-2021-22885 Criticality: High URL: https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI Title: Possible Information Disclosure / Unintended Method Execution in Action Pack Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8166 Criticality: Medium URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw Title: Ability to forge per-form CSRF tokens given a global CSRF token Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8164 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY Title: Possible Strong Parameters Bypass in ActionPack Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2021-22904 Criticality: High URL: https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ Title: Possible DoS Vulnerability in Action Controller Token Authentication Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, ~> 6.0.3, >= 6.0.3.7, >= 6.1.3.2 Name: actionpack Version: 5.1.4 Advisory: CVE-2022-23633 Criticality: High URL: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ Title: Possible exposure of information vulnerability in Action Pack Solution: upgrade to ~> 5.2.6, >= 5.2.6.2, ~> 6.0.4, >= 6.0.4.6, ~> 6.1.4, >= 6.1.4.6, >= 7.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2020-15169 Criticality: Medium URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc Title: Potential XSS vulnerability in Action View Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-5267 Criticality: Medium URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8 Title: Possible XSS vulnerability in ActionView Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2020-8167 Criticality: Medium URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0 Title: CSRF Vulnerability in rails-ujs Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5419 Criticality: High URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI Title: Denial of Service Vulnerability in Action View Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5418 Criticality: High URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q Title: File Content Disclosure in Action View Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3 Name: activejob Version: 5.1.4 Advisory: CVE-2018-16476 Criticality: High URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw Title: Broken Access Control vulnerability in Active Job Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1 Name: activerecord Version: 5.1.4 Advisory: CVE-2021-22880 Criticality: Medium URL: https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI Title: Possible DoS Vulnerability in Active Record PostgreSQL adapter Solution: upgrade to ~> 5.2.4, >= 5.2.4.5, ~> 6.0.3, >= 6.0.3.5, >= 6.1.2.1 Name: activesupport Version: 5.1.4 Advisory: CVE-2020-8165 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore Solution: upgrade to ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1 Name: addressable Version: 2.5.2 Advisory: CVE-2021-32740 Criticality: High URL: GHSA-jxhc-q857-3j6g Title: Regular Expression Denial of Service in Addressable templates Solution: upgrade to >= 2.8.0 Name: carrierwave Version: 1.2.1 Advisory: CVE-2021-21288 Criticality: Medium URL: GHSA-fwcm-636p-68r5 Title: Server-side request forgery in CarrierWave Solution: upgrade to ~> 1.3.2, >= 2.1.1 Name: carrierwave Version: 1.2.1 Advisory: CVE-2021-21305 Criticality: High URL: GHSA-cf3w-g86h-35x4 Title: Code Injection vulnerability in CarrierWave::RMagick Solution: upgrade to ~> 1.3.2, >= 2.1.1 Name: ffi Version: 1.9.18 Advisory: CVE-2018-1000201 Criticality: High URL: https://github.com/ffi/ffi/releases/tag/1.9.24 Title: ruby-ffi DDL loading issue on Windows OS Solution: upgrade to >= 1.9.24 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2020-11023 Criticality: Medium URL: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released Title: Potential XSS vulnerability in jQuery Solution: upgrade to >= 4.4.0 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2019-11358 Criticality: Medium URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ Title: Prototype pollution attack through jQuery $.extend Solution: upgrade to >= 4.3.4 Name: jquery-ui-rails Version: 5.0.5 Advisory: CVE-2016-7103 Criticality: Medium URL: jquery/api.jqueryui.com#281 Title: XSS Vulnerability on closeText option of Dialog jQuery UI Solution: upgrade to >= 6.0.0 Name: kaminari Version: 1.1.1 Advisory: CVE-2020-11082 Criticality: Medium URL: GHSA-r5jw-62xg-j433 Title: Cross-Site Scripting in Kaminari via `original_script_name` parameter Solution: upgrade to >= 1.2.1 Name: loofah Version: 2.1.1 Advisory: CVE-2019-15587 Criticality: Medium URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: loofah Version: 2.1.1 Advisory: CVE-2018-16468 Criticality: Medium URL: flavorjones/loofah#154 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.3 Name: loofah Version: 2.1.1 Advisory: CVE-2018-8048 Criticality: Medium URL: flavorjones/loofah#144 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.1 Name: mini_magick Version: 4.8.0 Advisory: CVE-2019-13574 Criticality: High URL: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/ Title: Remote command execution via filename Solution: upgrade to >= 4.9.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-5477 Criticality: Critical URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2021-41098 Criticality: High URL: GHSA-2rr5-8q37-2w7h Title: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby Solution: upgrade to >= 1.12.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-11068 Criticality: Unknown URL: sparklemotion/nokogiri#1892 Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability Solution: upgrade to >= 1.10.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-14404 Criticality: High URL: sparklemotion/nokogiri#1785 Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Solution: upgrade to >= 1.8.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2017-15412 Criticality: Unknown URL: sparklemotion/nokogiri#1714 Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities Solution: upgrade to >= 1.8.2 Name: nokogiri Version: 1.8.1 Advisory: CVE-2022-24839 Criticality: High URL: GHSA-9849-p7jc-9rmv Title: Denial of Service (DoS) in Nokogiri on JRuby Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2022-23437 Criticality: Medium URL: GHSA-xxx9-3xcr-gjj3 Title: XML Injection in Xerces Java affects Nokogiri Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2021-30560 Criticality: High URL: GHSA-fq42-c5rg-92c2 Title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35) Solution: upgrade to >= 1.13.2 Name: nokogiri Version: 1.8.1 Advisory: GHSA-7rrm-v45f-jp64 Criticality: High URL: GHSA-7rrm-v45f-jp64 Title: Update packaged dependency libxml2 from 2.9.10 to 2.9.12 Solution: upgrade to >= 1.11.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-25032 Criticality: High URL: GHSA-v6gp-9mmm-c6p5 Title: Out-of-bounds Write in zlib affects Nokogiri Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: sparklemotion/nokogiri#1746 Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS Solution: upgrade to >= 1.8.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-7595 Criticality: High URL: sparklemotion/nokogiri#1992 Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation Solution: upgrade to >= 1.10.8 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2022-24836 Criticality: High URL: GHSA-crjr-9rc5-ghw8 Title: Inefficient Regular Expression Complexity in Nokogiri Solution: upgrade to >= 1.13.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-26247 Criticality: Low URL: GHSA-vr8q-g5c7-m54m Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability Solution: upgrade to >= 1.11.0.rc4 Name: puma Version: 4.3.3 Advisory: CVE-2021-29509 Criticality: High URL: GHSA-q28m-8xjw-8vr5 Title: Keepalive Connections Causing Denial Of Service in puma Solution: upgrade to ~> 4.3.8, >= 5.3.1 Name: puma Version: 4.3.3 Advisory: CVE-2022-24790 Criticality: Critical URL: GHSA-h99w-9q5r-gjq9 Title: HTTP Request Smuggling in puma Solution: upgrade to ~> 4.3.12, >= 5.6.4 Name: puma Version: 4.3.3 Advisory: CVE-2020-11076 Criticality: High URL: GHSA-x7jg-6pwg-fx5h Title: HTTP Smuggling via Transfer-Encoding Header in Puma Solution: upgrade to ~> 3.12.5, >= 4.3.4 Name: puma Version: 4.3.3 Advisory: CVE-2020-11077 Criticality: Medium URL: GHSA-w64w-qqph-5gxm Title: HTTP Smuggling via Transfer-Encoding Header in Puma Solution: upgrade to ~> 3.12.6, >= 4.3.5 Name: puma Version: 4.3.3 Advisory: CVE-2022-23634 Criticality: High URL: GHSA-rmj8-8hhh-gv5h Title: Information Exposure with Puma when used with Rails Solution: upgrade to ~> 4.3.11, >= 5.6.2 Name: puma Version: 4.3.3 Advisory: CVE-2021-41136 Criticality: Low URL: GHSA-48w2-rm65-62xx Title: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma Solution: upgrade to ~> 4.3.9, >= 5.5.1 Name: rack Version: 2.2.2 Advisory: CVE-2020-8184 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names Solution: upgrade to ~> 2.1.4, >= 2.2.3 Name: rails-html-sanitizer Version: 1.0.3 Advisory: CVE-2018-3741 Criticality: Unknown URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ Title: XSS vulnerability in rails-html-sanitizer Solution: upgrade to >= 1.0.4 Name: rails_admin Version: 1.2.0 Advisory: CVE-2020-36190 Criticality: Medium URL: railsadminteam/rails_admin@d72090e Title: rails_admin ruby gem XSS vulnerability Solution: upgrade to ~> 1.4.3, >= 2.0.2 Name: rails_admin Version: 1.2.0 Advisory: CVE-2017-12098 Criticality: Medium URL: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0450 Title: rails_admin ruby gem XSS vulnerability Solution: upgrade to >= 1.3.0 Name: rake Version: 12.3.0 Advisory: CVE-2020-8130 Criticality: High URL: GHSA-jppv-gw3r-w3q8 Title: OS Command Injection in Rake Solution: upgrade to >= 12.3.3 Name: redcarpet Version: 3.4.0 Advisory: CVE-2020-26298 Criticality: Medium URL: vmg/redcarpet@a699c82 Title: Injection/XSS in Redcarpet Solution: upgrade to >= 3.5.1 Name: websocket-extensions Version: 0.1.3 Advisory: CVE-2020-7663 Criticality: High URL: GHSA-g6wq-qcwm-j5g2 Title: Regular Expression Denial of Service in websocket-extensions (RubyGem) Solution: upgrade to >= 0.1.5

flavorjones added the topic/security label Nov 17, 2019

flavorjones added a commit that referenced this issue Nov 17, 2019

add security note to CHANGELOG

061d75d

related to #1943

flavorjones added a commit that referenced this issue Nov 17, 2019

add security note to CHANGELOG

6cf337e

related to #1943

flavorjones closed this as completed Nov 17, 2019

primeos added a commit to NixOS/nixpkgs that referenced this issue Nov 17, 2019

html-proofer: 3.13.0 -> 3.14.0 (security)

46ed8ed

This also updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943

primeos added a commit to NixOS/nixpkgs that referenced this issue Nov 17, 2019

jekyll: Update the dependencies (security)

ad13058

This updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943

primeos added a commit to NixOS/nixpkgs that referenced this issue Nov 17, 2019

gollum: Update the dependencies (security)

55f4feb

This updates Nokogiri to 1.10.5 for CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197 [0]. [0]: sparklemotion/nokogiri#1943

arku mentioned this issue Nov 18, 2019

Update Nokogiri to fix CVE-2019-13117 railslink/railslink#119

Merged

ferristseng mentioned this issue Nov 18, 2019

Upgrade nokogiri to 1.10.5 department-of-veterans-affairs/caseflow#12735

Merged

adongare added a commit to projecttacoma/cqm-parsers that referenced this issue Nov 19, 2019

BONNIE-593 Bonnie Unresponsive Message and Error Loading Measure Pack…

c89f0f2

…ages Fixed vulnerability: sparklemotion/nokogiri#1943

roback added a commit to twingly/feedbag.herokuapp.com that referenced this issue Nov 21, 2019

Update nokogiri (CVE-2019-13117)

8515e65

sparklemotion/nokogiri#1943

roback added a commit to twingly/feedjira.herokuapp.com that referenced this issue Nov 21, 2019

Update nokogiri (CVE-2019-13117)

1737f9b

sparklemotion/nokogiri#1943

selzoc added a commit to cloudfoundry/cloud_controller_ng that referenced this issue Nov 21, 2019

Bump nokogiri gem for CVE

22c5fa0

See sparklemotion/nokogiri#1943

This was referenced Nov 25, 2019

Ruby gem vulnerability CVE-2019-13117 vmware-archive/octant#445

Closed

Ruby gem vulnerability CVE-2019-13117 vmware-tanzu/velero#2092

Closed

senid231 mentioned this issue Dec 11, 2019

Fix import preview and vulnerabilities [1.9] yeti-switch/yeti-web#576

Merged

johnsyweb mentioned this issue Dec 19, 2019

Automated Bundle Update envato-archive/unwrappr-demo#7

Merged

sobanakram mentioned this issue Dec 20, 2019

Automated Bundle Update sobanakram/rails_api_template#6

Merged

AdrianCann mentioned this issue Oct 10, 2020

Update gems to fix all the CVEs sophomoric/secret#96

Merged

github-actions bot mentioned this issue Jun 3, 2021

Security Alert Test lazy-actions/gitrivy#99

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Investigate libxslt vulnerabilities patched in USN-4164-1 #1943

Investigate libxslt vulnerabilities patched in USN-4164-1 #1943

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

Investigate libxslt vulnerabilities patched in USN-4164-1 #1943

Investigate libxslt vulnerabilities patched in USN-4164-1 #1943

Comments

flavorjones commented Nov 17, 2019 • edited Loading

Summary (2019-11-17)

History of this notification:

flavorjones commented Nov 17, 2019 • edited Loading

CVE-2019-13117

flavorjones commented Nov 17, 2019 • edited Loading

CVE-2019-13118

flavorjones commented Nov 17, 2019 • edited Loading

CVE-2019-18197

flavorjones commented Nov 17, 2019 • edited Loading

Summary

Actions

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading

flavorjones commented Nov 17, 2019 •

edited

Loading