WS-2022-0334 (Medium) detected in nokogiri-1.10.9.gem - autoclosed

[mend-for-github-com[bot]]

WS-2022-0334 - Medium Severity Vulnerability

Vulnerable Library - nokogiri-1.10.9.gem

Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser. Among Nokogiri's many features is the ability to search documents via XPath or CSS3 selectors.

Library home page: https://rubygems.org/gems/nokogiri-1.10.9.gem

Dependency Hierarchy: - html-proofer-3.15.2.gem (Root Library) - nokogumbo-2.0.2.gem - :x: **nokogiri-1.10.9.gem** (Vulnerable Library)

Vulnerability Details

nokogiri up to and including 1.13.8 is affected by several vulnerabilities (CVE-2022-40303, CVE-2022-40304 and CVE-2022-2309) in the dependency bundled libxml2 library. Version 1.13.9 of nokogiri contains a patch where the dependency is upgraded with the patches as well.

Publish Date: 2022-10-18

URL: WS-2022-0334

CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-2qc6-mcvw-92cw

Release Date: 2022-10-18

Fix Resolution: nokogiri - 1.13.9

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.