CVE-2017-5029
nokogiri Moderate
Buffer Errors
Discovered over 3 years ago
Published over 3 years ago
Category: Buffer Errors
Source: GitHub
Severity: Moderate

nokogiri version 1.7.2 has been released.

This is a security update based on 1.7.1, addressing two upstream libxslt 1.1.29 vulnerabilities classified as “Medium” by Canonical and given a CVSS3 score of “6.5 Medium” and “8.8 High” by RedHat.

These patches only apply when using Nokogiri’s vendored libxslt package. If you’re using your distro’s system libraries, there’s no need to upgrade from 1.7.0.1 or 1.7.1 at this time.

Full details are available at the github issue linked to in the changelog below.


1.7.2 / 2017-05-09

Security Notes

[MRI] Upstream libxslt patches are applied to the vendored libxslt 1.1.29 which address CVE-2017-5029 and CVE-2016-4738.

For more information:

  • https://github.com/sparklemotion/nokogiri/issues/1634
  • http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
  • http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
CVSS Metrics
Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
n/a n/a n/a n/a n/a n/a
Patched Versions

>= 1.7.2

Unaffected Versions

n/a

References

n/a