Nokogiri subject to DoS via libxml2 vulnerability
High severity
GitHub Reviewed
Published
Aug 21, 2018
to the GitHub Advisory Database
•
Updated Aug 25, 2023
Description
Published to the GitHub Advisory Database
Aug 21, 2018
Reviewed
Jun 16, 2020
Last updated
Aug 25, 2023
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
References