WS-2022-0334 (Medium) detected in nokogiri-1.13.4-x86_64-linux.gem - autoclosed

[mend-bolt-for-github[bot]]

WS-2022-0334 - Medium Severity Vulnerability

Vulnerable Library - nokogiri-1.13.4-x86_64-linux.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.13.4-x86_64-linux.gem

Path to vulnerable library: /_vendor/bundle/ruby/2.7.0/cache/nokogiri-1.13.4-x86_64-linux.gem

Dependency Hierarchy: - :x: **nokogiri-1.13.4-x86_64-linux.gem** (Vulnerable Library)

Found in HEAD commit: a3c53bb5594376e2ea86293b4e0f27324f4715ad

Found in base branch: master

Vulnerability Details

nokogiri up to and including 1.13.8 is affected by several vulnerabilities (CVE-2022-40303, CVE-2022-40304 and CVE-2022-2309) in the dependency bundled libxml2 library. Version 1.13.9 of nokogiri contains a patch where the dependency is upgraded with the patches as well.

Publish Date: 2022-10-18

URL: WS-2022-0334

CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-2qc6-mcvw-92cw

Release Date: 2022-10-18

Fix Resolution: nokogiri - 1.13.9

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.