[ GLSA 202006-05 ] Nokogiri

[GLSA]

Gentoo Linux Security Advisory

Title: Nokogiri: Command injection (GLSA 202006-05)
Severity: normal
Exploitable: remote
Date: 2020-06-13
Bug(s): #691974
ID: 202006-05

Synopsis

Nokogiri has a vulnerability allowing arbitrary execution of code
if a certain function is used.


Background

Nokogiri is an HTML, XML, SAX, and Reader parser.

Affected Packages

Package: dev-ruby/nokogiri
Vulnerable: < 1.10.4
Unaffected: >= 1.10.4
Architectures: All supported architectures


Description

A command injection vulnerability in Nokogiri allows commands to be
executed in a subprocess by Ruby’s Kernel.open method. Processes are
vulnerable only if the undocumented method
Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process.


Workaround

Avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file
with untrusted user input.


Resolution

All Nokogiri users should upgrade to the latest version: