Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] Update mechanize: 2.7.2 → 2.7.7 (patch) #175

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🚨 [security] Update mechanize: 2.7.2 → 2.7.7 (patch) #175

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Feb 2, 2021

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ mechanize (2.7.2 → 2.7.7) · Repo · Changelog

Security Advisories 🚨

🚨 Mechanize ruby gem Command Injection vulnerability

Impact

Mechanize >= v2.0, < v2.7.7 allows for OS commands to be injected using several
classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is
possible only if untrusted input is used as a local filename and passed to any of
these calls:

  • Mechanize::CookieJar#load: since v2.0 (see 208e3ed)
  • Mechanize::CookieJar#save_as: since v2.0 (see 5b776a4)
  • Mechanize#download: since v2.2 (see dc91667)
  • Mechanize::Download#save and #save! since v2.1 (see 98b2f51, bd62ff0)
  • Mechanize::File#save and #save_as: since v2.1 (see 2bf7519)
  • Mechanize::FileResponse#read_body: since v2.0 (see 01039f5)

Patches

These vulnerabilities are patched in Mechanize v2.7.7.

Workarounds

No workarounds are available. We recommend upgrading to v2.7.7 or later.

References

See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background
on why Kernel.open should not be used with untrusted input.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ domain_name (indirect, 0.5.19 → 0.5.20190701) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 56 commits:

↗️ http-cookie (indirect, 1.0.2 → 1.0.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ mini_portile2 (indirect, 2.4.0 → 2.5.0) · Repo · Changelog

Release Notes

2.5.0

2.5.0 / 2020-02-24

Enhancements

  • When verifying GPG signatures, remove all imported pubkeys from keyring [#90] (Thanks, @hanazuki!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ net-http-digest_auth (indirect, 1.4 → 1.4.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 8 commits:

↗️ net-http-persistent (indirect, 2.9.4 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1 (from changelog)

* Loosen Ruby version requirement so Ruby 3.0 will work.

4.0.0 (from changelog)

* Removed built-in support for retrying failed requests as Net::HTTP has this
  built-in for all supported versions.  Pull request #100 by Michael Grosser.
* Dropped support for EoL ruby versions (< 2.4).  Future feature releases may
  drop support for ruby versions that are at end-of-life or in security-only
  maintenance mode with any release.  Pull request #113 by David Rodríguez

    

  • 

    Added Net::HTTP::Persistent#max_retries= to configure the number of retries
    
performed on a request for ruby versions that support it (2.5+).
    

    • 

  • 

    URI-ness is determined through #respond_to? to allow compatibility with
    
Addressable::URI.  Pull request #67 by Ryan McKern.
    

    • 

  • 

    Use require_relative to reduce patch burden for vendored versions.  Pull
    
Request #106 by David Rodríguez
    

    • 

  • 

    Stop wasting a connection when the keep-alive timeout is less than the idle
    
timeout.  Pull request #115 by Yap Sok Ann.
    

    • 

  • 

    Improved use of URI#hostname for IPv6 connections.  Pull request #76 by
    
Tomas Koutsky.
    

    • 

  • 

    Improved check for Process::RLIMIT_NOFILE support.  Pull request #109 by Vít
    
Ondruch.
    

    • 

  • 

    Fix namespace in comments for escape/unescape wrappers.  Pull request #114
    
by David Rodríguez.
    

    • 

  • 

    Fix History.txt timestamp for 3.0.0 release.  Pull request #107 by Joe Van
    
Dyk.
    

    • 

  • 

    Fix link to PR #98 in 3.1.0 release notes.  Pull request #110 by Justin
    
Reid.
    

    • 

  • 

    Updated Net::HTTP::Persistent#reconnect documentation to indicate that all
    
connections are reset.  Issue #117 by Taisuke Miyazaki.
    

    •

3.1.0

New features:

  • Support ruby 2.6 Net::HTTP#write_timeout=. Pull request #99 by Víctor
    Roldán Betancort.
  • Support setting TLS min/max version. Pull request #94 by Bart.

Bug fixes:

  • Reduce potential for memory leak through Hash default proc bindings. Pull
    request #64 by Dominic Metzger.
  • Test proxy auto detection from no_proxy in ENV. Pull request #60 by
    HINOHARA Hiroshi.
  • Add missing timestamp for 3.0 release. Pull request #78 by Joe Van Dyk.
  • Support IPv6 URLs in proxy checks. Pull request #82 by Nicolás Sanguinetti.
  • Use Net::HTTPGenericRequest#method to check idempotence for improved
    compatibility. Pull request #83 by Fotos Georgiadis.
  • Run net-http-pipeline tests in travis. Pull request #86 by T.J. Schuck.
  • Correct +no_proxy+ support to override Net::HTTP proxy fallback. Pull
    request #88 by Jared Kauppila.
  • Mitigate memory leak when combined with faraday. Pull request #105 by Yohei
    Kitamura.
  • Set default connection pool size for Windows. Pull request #90 by Jared
    Kauppila.
  • Fix missing +name:+ argument in documentation. Pull requests #85 by T.J.
    Schuck, #84 by James White.
  • Fix memory leak from connection pooling. Pull request #97 by Aaron
    Patterson.
  • Update tests for minitest assert_equal deprecation. Pull request #92 by
    Olle Jonsson.
  • Fix typo in Net::HTTP::Persistent#pipeline. Pull request #91 by Kazuma
    Furuhashi.

Other:

  • Added bundler hoe plugin. Pull request #103 by Michael Grosser.
  • Updated ruby versions in Travis CI. Pull request #93 by Olle Jonsson. Pull
    request #103 by Michael Grosser.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.10.1 → 1.11.1) · Repo · Changelog

Security Advisories 🚨

🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability

Description

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.

This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.

Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".

Affected Versions

Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3

Mitigation

There are no known workarounds for affected versions. Upgrade to Nokogiri
1.11.0.rc4 or later.

If, after upgrading to 1.11.0.rc4 or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):

  1. Ensure the input is trusted. Do not enable this option
    for untrusted input.
  2. When invoking the Nokogiri::XML::Schema constructor,
    pass as the second parameter an instance of Nokogiri::XML::ParseOptions with the
    NONET flag turned off.

So if your previous code was:

# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network
# but in v1.11.0.rc4 and later, this call will disallow network access for external resources
schema = Nokogiri::XML::Schema.new(schema)

# in v1.11.0.rc4 and later, the following is equivalent to the code above

# (the second parameter is optional, and this demonstrates its default value)

schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)

Then you can add the second parameter to indicate that the input is trusted by changing it to:

# in v1.11.0.rc3 and earlier, this would raise an ArgumentError
# but in v1.11.0.rc4 and later, this allows resources to be accessed over the network
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)

🚨 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

🚨 Nokogiri gem, via libxslt, is affected by multiple vulnerabilities

Nokogiri v1.10.5 has been released.

This is a security release. It addresses three CVEs in upstream libxml2,
for which details are below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
these vulnerabilities.

Full details about the security update are available in Github Issue
[#1943] #1943.

CVE-2019-13117

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
could allow an attacker to discern whether a byte on the stack contains the
characters A, a, I, i, or 0, or any other character.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1

CVE-2019-13118

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
xsl:number instruction was too narrow and an invalid character/length
combination could be passed to xsltNumberFormatDecimal, leading to a read
of uninitialized stack data

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b

CVE-2019-18197

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html

Priority: Medium

Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
reset under certain circumstances. If the relevant memory area happened to
be freed and reused in a certain way, a bounds check could fail and memory
outside a buffer could be written to, or uninitialized data could be
disclosed.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285

🚨 Nokogiri Command Injection Vulnerability

🚨 Nokogiri gem, via libxslt, is affected by improper access control vulnerability

Nokogiri v1.10.3 has been released.

This is a security release. It addresses a CVE in upstream libxslt rated as
"Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
details are available below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time, though
you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that this patch is not yet (as
of 2019-04-22) in an upstream release of libxslt.

Full details about the security update are available in Github Issue
[#1892] #1892.

CVE-2019-11068

Permalinks are:

Description:

libxslt through 1.1.33 allows bypass of a protection mechanism
because callers of xsltCheckRead and xsltCheckWrite permit access
even upon receiving a -1 error code. xsltCheckRead can return -1 for
a crafted URL that is not actually invalid and is subsequently
loaded.

Canonical rates this as "Priority: Medium".

Debian rates this as "NVD Severity: High (attack range: remote)".

Release Notes

1.11.1

v1.11.1 / 2021-01-06

Fixed

  • [CRuby] If libxml-ruby is loaded before nokogiri, the SAX and Push parsers no longer call libxml-ruby's handlers. Instead, they defensively override the libxml2 global handler before parsing. [#2168]

SHA-256 Checksums of published gems

a41091292992cb99be1b53927e1de4abe5912742ded956b0ba3383ce4f29711c  nokogiri-1.11.1-arm64-darwin.gem
d44fccb8475394eb71f29dfa7bb3ac32ee50795972c4557ffe54122ce486479d  nokogiri-1.11.1-java.gem
f760285e3db732ee0d6e06370f89407f656d5181a55329271760e82658b4c3fc  nokogiri-1.11.1-x64-mingw32.gem
dd48343bc4628936d371ba7256c4f74513b6fa642e553ad7401ce0d9b8d26e1f  nokogiri-1.11.1-x86-linux.gem
7f49138821d714fe2c5d040dda4af24199ae207960bf6aad4a61483f896bb046  nokogiri-1.11.1-x86-mingw32.gem
5c26111f7f26831508cc5234e273afd93f43fbbfd0dcae5394490038b88d28e7  nokogiri-1.11.1-x86_64-darwin.gem
c3617c0680af1dd9fda5c0fd7d72a0da68b422c0c0b4cebcd7c45ff5082ea6d2  nokogiri-1.11.1-x86_64-linux.gem
42c2a54dd3ef03ef2543177bee3b5308313214e99f0d1aa85f984324329e5caa  nokogiri-1.11.1.gem

1.11.0

v1.11.0 / 2021-01-03

Notes

Faster, more reliable installation: Native Gems for Linux and OSX/Darwin

"Native gems" contain pre-compiled libraries for a specific machine architecture. On supported platforms, this removes the need for compiling the C extension and the packaged libraries. This results in much faster installation and more reliable installation, which as you probably know are the biggest headaches for Nokogiri users.

We've been shipping native Windows gems since 2009, but starting in v1.11.0 we are also shipping native gems for these platforms:

  • Linux: x86-linux and x86_64-linux -- including musl platforms like alpine
  • OSX/Darwin: x86_64-darwin and arm64-darwin

We'd appreciate your thoughts and feedback on this work at #2075.

Dependencies

Ruby

This release introduces support for Ruby 2.7 and 3.0 in the precompiled native gems.

This release ends support for:

Gems

  • Explicitly add racc as a runtime dependency. [#1988] (Thanks, @voxik!)
  • [MRI] Upgrade mini_portile2 dependency from ~> 2.4.0 to ~> 2.5.0 [#2005] (Thanks, @alejandroperea!)

Security

See note below about CVE-2020-26247 in the "Changed" subsection entitled "XML::Schema parsing treats input as untrusted by default".

Added

  • Add Node methods for manipulating "keyword attributes" (for example, class and rel): #kwattr_values, #kwattr_add, #kwattr_append, and #kwattr_remove. [#2000]
  • Add support for CSS queries a:has(> b), a:has(~ b), and a:has(+ b). [#688] (Thanks, @jonathanhefner!)
  • Add Node#value? to better match expected semantics of a Hash-like object. [#1838, #1840] (Thanks, @MatzFan!)
  • [CRuby] Add Nokogiri::XML::Node#line= for use by downstream libs like nokogumbo. [#1918] (Thanks, @stevecheckoway!)
  • nokogiri.gemspec is back after a 10-year hiatus. We still prefer you use the official releases, but master is pretty stable these days, and YOLO.

Performance

  • [CRuby] The CSS ~= operator and class selector . are about 2x faster. [#2137, #2135]
  • [CRuby] Patch libxml2 to call strlen from xmlStrlen rather than the naive implementation, because strlen is generally optimized for the architecture. [#2144] (Thanks, @ilyazub!)
  • Improve performance of some namespace operations. [#1916] (Thanks, @ashmaroli!)
  • Remove unnecessary array allocations from Node serialization methods [#1911] (Thanks, @ashmaroli!)
  • Avoid creation of unnecessary zero-length String objects. [#1970] (Thanks, @ashmaroli!)
  • Always compile libxml2 and libxslt with '-O2' [#2022, #2100] (Thanks, @ilyazub!)
  • [JRuby] Lots of code cleanup and performance improvements. [#1934] (Thanks, @kares!)
  • [CRuby] RelaxNG.from_document no longer leaks memory. [#2114]

Improved

  • [CRuby] Handle incorrectly-closed HTML comments as WHATWG recommends for browsers. [#2058] (Thanks to HackerOne user mayflower for reporting this!)
  • {HTML,XML}::Document#parse now accept Pathname objects. Previously this worked only if the referenced file was less than 4096 bytes long; longer files resulted in undefined behavior because the read method would be repeatedly invoked. [#1821, #2110] (Thanks, @doriantaylor and @phokz!)
  • [CRuby] Nokogumbo builds faster because it can now use header files provided by Nokogiri. [#1788] (Thanks, @stevecheckoway!)
  • Add frozen_string_literal: true magic comment to all lib files. [#1745] (Thanks, @oniofchaos!)
  • [JRuby] Clean up deprecated calls into JRuby. [#2027] (Thanks, @headius!)

Fixed

  • HTML Parsing in "strict" mode (i.e., the RECOVER parse option not set) now correctly raises a XML::SyntaxError exception. Previously the value of the RECOVER bit was being ignored by CRuby and was misinterpreted by JRuby. [#2130]
  • The CSS ~= operator now correctly handles non-space whitespace in the class attribute. commit e45dedd
  • The switch to turn off the CSS-to-XPath cache is now thread-local, rather than being shared mutable state. [#1935]
  • The Node methods add_previous_sibling, previous=, before, add_next_sibling, next=, after, replace, and swap now correctly use their parent as the context node for parsing markup. These methods now also raise a RuntimeError if they are called on a node with no parent. [nokogumbo#160]
  • [JRuby] XML::Schema XSD validation errors are captured in XML::Schema#errors. These errors were previously ignored.
  • [JRuby] Standardize reading from IO like objects, including StringIO. [#1888, #1897]
  • [JRuby] Fix how custom XPath function namespaces are inferred to be less naive. [#1890, #2148]
  • [JRuby] Clarify exception message when custom XPath functions can't be resolved.
  • [JRuby] Comparison of Node to Document with Node#<=> now matches CRuby/libxml2 behavior.
  • [CRuby] Syntax errors are now correctly captured in Document#errors for short HTML documents. Previously the SAX parser used for encoding detection was clobbering libxml2's global error handler.
  • [CRuby] Fixed installation on AIX with respect to vasprintf. [#1908]
  • [CRuby] On some platforms, avoid symbol name collision with glibc's canonicalize. [#2105]
  • [Windows Visual C++] Fixed compiler warnings and errors. [#2061, #2068]
  • [CRuby] Fixed Nokogumbo integration which broke in the v1.11.0 release candidates. [#1788] (Thanks, @stevecheckoway!)
  • [JRuby] Fixed document encoding regression in v1.11.0 release candidates. [#2080, #2083] (Thanks, @thbar!)

Removed

  • The internal method Nokogiri::CSS::Parser.cache_on= has been removed. Use .set_cache if you need to muck with the cache internals.
  • The class method Nokogiri::CSS::Parser.parse has been removed. This was originally deprecated in 2009 in 13db61b. Use Nokogiri::CSS.parse instead.

Changed

XML::Schema input is now "untrusted" by default

Address CVE-2020-26247.

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema were trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.

This behavior is counter to the security policy intended by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible.

Please note that this security fix was pushed into a new minor version, 1.11.x, rather than a patch release to the 1.10.x branch, because it is a breaking change for some schemas and the risk was assessed to be "Low Severity".

More information and instructions for enabling "trusted input" behavior in v1.11.0.rc4 and later is available at the public advisory.

HTML parser now obeys the strict or norecover parsing option

(Also noted above in the "Fixed" section) HTML Parsing in "strict" mode (i.e., the RECOVER parse option not set) now correctly raises a XML::SyntaxError exception. Previously the value of the RECOVER bit was being ignored by CRuby and was misinterpreted by JRuby.

If you're using the default parser options, you will be unaffected by this fix. If you're passing strict or norecover to your HTML parser call, you may be surprised to see that the parser now fails to recover and raises a XML::SyntaxError exception. Given the number of HTML documents on the internet that libxml2 would consider to be ill-formed, this is probably not what you want, and you can omit setting that parse option to restore the behavior that you have been relying upon.

Apologies to anyone inconvenienced by this breaking bugfix being present in a minor release, but I felt it was appropriate to introduce this fix because it's straightforward to fix any code that has been relying on this buggy behavior.

VersionInfo, the output of nokogiri -v, and related constants

This release changes the metadata provided in Nokogiri::VersionInfo which also affects the output of nokogiri -v. Some related constants have also been changed. If you're using VersionInfo programmatically, or relying on constants related to underlying library versions, please read the detailed changes for Nokogiri::VersionInfo at #2139 and accept our apologies for the inconvenience.

SHA-256 Checksums of published gems

17ed2567bf76319075b4a6a7258d1a4c9e2661fca933b03e037d79ae2b9910d0  nokogiri-1.11.0.gem
2f0149c735b0672c49171b18467ce25fd323a8e608c9e6b76e2b2fa28e7f66ee  nokogiri-1.11.0-java.gem
2f249be8cc705f9e899c07225fcbe18f4f7dea220a59eb5fa82461979991082e  nokogiri-1.11.0-x64-mingw32.gem
9e219401dc3f93abf09166d12ed99c8310fcaf8c56a99d64ff93d8b5f0604e91  nokogiri-1.11.0-x86-mingw32.gem
bda2a9c9debf51da7011830c7f2dc5771c122ebcf0fc2dd2c4ba4fc95b5c38f2  nokogiri-1.11.0-x86-linux.gem
d500c3202e2514b32f4b02049d9193aa825ae3e9442c9cad2d235446c3e17d8d  nokogiri-1.11.0-x86_64-linux.gem
3a613188e3b76d593b04e0ddcc46f44c288b13f80b32ce83957356f50e22f9ee  nokogiri-1.11.0-arm64-darwin.gem
b8f9b826d09494b20b30ecd048f5eb2827dccd85b77abeb8baf1f610e5ed28ed  nokogiri-1.11.0-x86_64-darwin.gem

1.10.10

1.10.10 / 2020-07-06

Features

  • [MRI] Cross-built Windows gems now support Ruby 2.7 [#2029]. Note that prior to this release, the v1.11.x prereleases provided this support.

1.10.9

1.10.9 / 2020-03-01

Fixed

  • [MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]
  • [JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, @headius!)

1.10.8

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7

1.10.7 / 2019-12-03

Bug

  • [MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6

1.10.6 / 2019-12-03

Bug

  • [MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5

1.10.5 / 2019-10-31

Dependencies

  • [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10
  • [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

1.10.4

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915)

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

This CVE's public notice is #1915

1.10.3

1.10.3 / 2019-04-22

Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in #1892. Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.

1.10.2

1.10.2 / 2019-03-24

Security

  • [MRI] Remove support from vendored libxml2 for future script macros. [#1871]
  • [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877]

Bug fixes

  • [JRuby] Fix node ownership in duplicated documents. [#1060]
  • [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, #1872] (Thanks, @adjam!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unf_ext (indirect, 0.0.6 → 0.0.7.7) · Repo · Changelog

Release Notes

0.0.7.7 (from changelog)

  • Include Windows binaries for Ruby 2.7.

0.0.7.6 (from changelog)

  • Version bump just for adding Windows binaries for Ruby 2.6.

Does any of this look wrong? Please let us know.

↗️ webrobots (indirect, 0.1.1 → 0.1.2) · Repo

Commits

See the full diff on Github. The new version differs by 17 commits:

🆕 racc (added, 1.5.2)

🆕 webrick (added, 1.7.0)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Feb 2, 2021
@depfu depfu bot mentioned this pull request Feb 2, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants