🚨 [security] Update loofah: 2.7.0 → 2.19.1 (minor)
Welcome to Depfu
This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.
After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.
Let us know if you have any questions. Thanks so much for giving Depfu a try!
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
↗ ️ loofah (indirect, 2.7.0 → 2.19.1) · Repo · Changelog
Security Advisories 🚨
🚨 Inefficient Regular Expression Complexity in Loofah
Summary
Loofah
< 2.19.1
contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.Mitigation
Upgrade to Loofah
>= 2.19.1
.Severity
The Loofah maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
- CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)
- https://hackerone.com/reports/1684163
Credit
This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
🚨 Improper neutralization of data URIs may allow XSS in Loofah
Summary
Loofah
>= 2.1.0, < 2.19.1
is vulnerable to cross-site scripting via theimage/svg+xml
media type in data URIs.Mitigation
Upgrade to Loofah
>= 2.19.1
.Severity
The Loofah maintainers have evaluated this as Medium Severity 6.1.
References
- CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)
- SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg
- https://hackerone.com/reports/1694173
- #101
Credit
This vulnerability was responsibly reported by Maciej Piechota (@haqpl).
🚨 Uncontrolled Recursion in Loofah
Summary
Loofah
>= 2.2.0, < 2.19.1
uses recursion for sanitizingCDATA
sections, making it susceptible to stack exhaustion and raising aSystemStackError
exception. This may lead to a denial of service through CPU resource consumption.Mitigation
Upgrade to Loofah
>= 2.19.1
.Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
Severity
The Loofah maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗ ️ mini_portile2 (indirect, 2.4.0 → 2.8.0) · Repo · Changelog
Release Notes
2.8.0
2.8.0 / 2022-02-20
Added
- Support xz-compressed archives (recognized by an
.xz
file extension).- When downloading a source archive, default open_timeout and read_timeout to 10 seconds, but allow configuration via open_timeout and read_timeout config parameters.
2.7.1
2.7.1 / 2021-10-20
Packaging
A test artifact that has been included in the gem was being flagged by some users' security scanners because it wasn't a real tarball. That artifact has been updated to be a real tarball. [#108]
2.7.0
2.7.0 / 2021-08-31
Added
The commands used for "make", "compile", and "cmake" are configurable via keyword arguments. [#107] (Thanks, @cosmo0920!)
2.6.1
2.6.1 / 2021-05-31
Dependencies
Make
net-ftp
an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called andnet-ftp
isn't available; this should only happen in Ruby 3.1 and later.
2.6.0
2.6.0 / 2021-05-31
Added
Recipes may build against a local directory by specifying
source_directory
instead offiles
. In
particular, this may be useful for debugging problems with the upstream dependency (e.g., usegit bisect
in a local clone) or for continuous integration with upstream HEAD.
2.5.3
2.5.3 / 2021-05-31
Make
net-ftp
an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called andnet-ftp
isn't available; this should only happen in Ruby 3.1 and later.
2.5.2
2.5.2 / 2021-05-28
Dependencies
Add
net-ftp
as an explicit dependency to accommodate the upcoming Ruby 3.1 changes that move this and other gems out of the "default" gem set and into the "bundled" gem set. See https://bugs.ruby-lang.org/issues/17873 [#101]
2.5.1
2.5.1 / 2021-04-28
Dependencies
This release ends support for ruby < 2.3.0. If you're on 2.2.x or earlier, we strongly suggest that you find the time to upgrade, because official support for Ruby 2.2 ended on 2018-03-31.
Enhancements
MiniPortile.execute
now takes an optional:env
hash, which is merged into the environment variables for the subprocess. Likely this is only useful for specialized use cases. [#99]- Experimental support for cmake-based projects extended to Windows. (Thanks, @larskanis!)
2.5.0
2.5.0 / 2020-02-24
Enhancements
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗ ️ nokogiri (indirect, 1.10.10 → 1.13.10) · Repo · Changelog
Security Advisories 🚨
🚨 Unchecked return value from xmlTextReaderExpand
Summary
Nokogiri
1.13.8, 1.13.9
fails to check the return value fromxmlTextReaderExpand
in the methodNokogiri::XML::Reader#attribute_hash
. This can lead to a null pointer exception when invalid markup is being parsed.For applications using
XML::Reader
to parse untrusted inputs, this may potentially be a vector for a denial of service attack.Mitigation
Upgrade to Nokogiri
>= 1.13.10
.Users may be able to search their code for calls to either
XML::Reader#attributes
orXML::Reader#attribute_hash
to determine if they are affected.Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
Credit
This vulnerability was responsibly reported by @davidwilemski.
🚨 Improper Handling of Unexpected Data Type in Nokogiri
Summary
Nokogiri
< v1.13.6
does not type-check all inputs into the XML and HTML4 SAX parsers.
For CRuby users, this may allow specially crafted untrusted inputs to cause illegal
memory access errors (segfault) or reads from unrelated memory.Severity
The Nokogiri maintainers have evaluated this as High 8.2 (CVSS3.1).
Mitigation
CRuby users should upgrade to Nokogiri
>= 1.13.6
.JRuby users are not affected.
Workarounds
To avoid this vulnerability in affected applications, ensure the untrusted input is a
String
by calling#to_s
or equivalent.
🚨 Integer Overflow or Wraparound in libxml2 affects Nokogiri
Summary
Nokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from
v2.9.13 to v2.9.14.libxml2 v2.9.14 addresses CVE-2022-29824.
This version also includes several security-related bug fixes for which CVEs were not created,
including a potential double-free, potential memory leaks, and integer-overflow.Please note that this advisory only applies to the CRuby implementation of Nokogiri
< 1.13.5
, and only if the packaged libraries are being used. If you've overridden
defaults at installation time to use system libraries instead of packaged libraries,
you should instead pay attention to your distro'slibxml2
andlibxslt
release announcements.Mitigation
Upgrade to Nokogiri
>= 1.13.5
.Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation:
compile and link Nokogiri against external libraries libxml2>= 2.9.14
which will also
address these same issues.Impact
CVE-2022-29824
libxml2
- CVSS3 score:
- Unspecified upstream
- Nokogiri maintainers evaluate at 8.6 (High) (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). Note that this is different from the CVSS assessed by NVD.
- Type: Denial of service, information disclosure
- Description: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24
All versions of libml2 prior to v2.9.14 are affected.
Applications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.
References
🚨 Denial of Service (DoS) in Nokogiri on JRuby
Summary
Nokogiri
v1.13.4
updates the vendoredorg.cyberneko.html
library to
1.9.22.noko2
which addresses CVE-2022-24839.
That CVE is rated 7.5 (High Severity).See GHSA-9849-p7jc-9rmv
for more information.Please note that this advisory only applies to the JRuby implementation of Nokogiri
< 1.13.4
.Mitigation
Upgrade to Nokogiri
>= 1.13.4
.Impact
CVE-2022-24839 in nekohtml
- Severity: High 7.5
- Type: CWE-400 Uncontrolled Resource Consumption
- Description: The fork of
org.cyberneko.html
used by Nokogiri (Rubygem) raises a
java.lang.OutOfMemoryError
exception when parsing ill-formed HTML markup.- See also: GHSA-9849-p7jc-9rmv
🚨 Inefficient Regular Expression Complexity in Nokogiri
Summary
Nokogiri
< v1.13.4
contains an inefficient regular expression that is
susceptible to excessive backtracking when attempting to detect encoding
in HTML documents.Mitigation
Upgrade to Nokogiri
>= 1.13.4
.
🚨 Out-of-bounds Write in zlib affects Nokogiri
Summary
Nokogiri v1.13.4 updates the vendored zlib from 1.2.11
to 1.2.12, which addresses CVE-2018-25032.
That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.Please note that this advisory only applies to the CRuby implementation of
Nokogiri< 1.13.4
, and only if the packaged version ofzlib
is being used.
Please see this document
for a complete description of which platform gems vendorzlib
. If you've
overridden defaults at installation time to use system libraries instead of
packaged libraries, you should instead pay attention to your distro'szlib
release announcements.Mitigation
Upgrade to Nokogiri
>= v1.13.4
.Impact
CVE-2018-25032 in zlib
- Severity: High
- Type: CWE-787
Out of bounds write- Description: zlib before 1.2.12 allows memory corruption when
deflating (i.e., when compressing) if the input has many distant matches.
🚨 XML Injection in Xerces Java affects Nokogiri
Summary
Nokogiri v1.13.4 updates the vendored
xerces:xercesImpl
from 2.12.0 to
2.12.2, which addresses CVE-2022-23437.
That CVE is scored as CVSS 6.5 "Medium" on the NVD record.Please note that this advisory only applies to the JRuby implementation
of Nokogiri< 1.13.4
.Mitigation
Upgrade to Nokogiri
>= v1.13.4
.Impact
CVE-2022-23437 in xerces-J
- Severity: Medium
- Type: CWE-91 XML Injection (aka Blind XPath Injection)
- Description: There's a vulnerability within the Apache Xerces Java
(XercesJ) XML parser when handling specially crafted XML document payloads.
This causes, the XercesJ XML parser to wait in an infinite loop, which may
sometimes consume system resources for prolonged duration. This vulnerability
is present within XercesJ version 2.12.1 and the previous versions.- See also: GHSA-h65f-jvqw-m9fj
🚨 Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
Summary
Nokogiri v1.13.2 upgrades two of its packaged dependencies:
- vendored libxml2 from v2.9.12 to v2.9.13
- vendored libxslt from v1.1.34 to v1.1.35
Those library versions address the following upstream CVEs:
- libxslt: CVE-2021-30560 (CVSS 8.8, High severity)
- libxml2: CVE-2022-23308 (Unspecified severity, see more information below)
Those library versions also address numerous other issues including performance
improvements, regression fixes, and bug fixes, as well as memory leaks and other
use-after-free issues that were not assigned CVEs.Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.13.2, and only if the packaged libraries are being used. If you've
overridden defaults at installation time to use system libraries instead of
packaged libraries, you should instead pay attention to your distro'slibxml2
andlibxslt
release announcements.Mitigation
Upgrade to Nokogiri >= 1.13.2.
Users who are unable to upgrade Nokogiri may also choose a more complicated
mitigation: compile and link an older version Nokogiri against external libraries
libxml2 >= 2.9.13 and libxslt >= 1.1.35, which will also address these same CVEs.Impact
- libxslt CVE-2021-30560
- CVSS3 score: 8.8 (High)
Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c
All versions of libxslt prior to v1.1.35 are affected.
Applications using untrusted XSL stylesheets to transform XML are vulnerable to
a denial-of-service attack and should be upgraded immediately.libxml2 CVE-2022-23308
- As of the time this security advisory was published, there is no officially
published information available about this CVE's severity. The above NIST link
does not yet have a published record, and the libxml2 maintainer has declined
to provide a severity score.- Fixed by https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12
- Further explanation is at https://mail.gnome.org/archives/xml/2022-February/msg00015.html
The upstream commit and the explanation linked above indicate that an application
may be vulnerable to a denial of service, memory disclosure, or code execution if
it parses an untrusted document with parse optionsDTDVALID
set to true, andNOENT
set to false.An analysis of these parse options:
- While
NOENT
is off by default for Document, DocumentFragment, Reader, and
Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri
v1.12.0 and later.DTDVALID
is an option that Nokogiri does not set for any operations, and so
this CVE applies only to applications setting this option explicitly.It seems reasonable to assume that any application explicitly setting the parse
optionDTDVALID
when parsing untrusted documents is vulnerable and should be
upgraded immediately.
🚨 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.)
Impact
In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default.
Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
- Nokogiri::XML::SAX::Parser
- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
- Nokogiri::XML::SAX::PushParser
- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser
Mitigation
JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.
CRuby users are not affected.
🚨 Update packaged dependency libxml2 from 2.9.10 to 2.9.12
Summary
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:
- CVE-2019-20388 (Medium severity)
- CVE-2020-24977 (Medium severity)
- CVE-2021-3517 (Medium severity)
- CVE-2021-3518 (Medium severity)
- CVE-2021-3537 (Low severity)
- CVE-2021-3541 (Low severity)
Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via
xmllint
is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992).Please note that this advisory only applies to the CRuby implementation of Nokogiri
< 1.11.4
, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro'slibxml2
release announcements.Mitigation
Upgrade to Nokogiri
>= 1.11.4
.Impact
I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.
All information below is sourced from security.archlinux.org, which appears to have the most up-to-date information as of this analysis.
CVE-2019-20388
- Severity: Medium
- Type: Denial of service
- Description: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2020-7595
- Severity: Medium
- Type: Denial of service
- Description: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
This has been patched in Nokogiri since v1.10.8 (see #1992).
CVE-2020-24977
- Severity: Medium
- Type: Information disclosure
- Description: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3516
- Severity: Medium
- Type: Arbitrary code execution (no remote vector)
- Description: A use-after-free security issue was found libxml2 before version 2.9.11 when "xmllint --html --push" is used to process crafted files.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship
xmllint
.CVE-2021-3517
- Severity: Medium
- Type: Arbitrary code execution
- Description: A heap-based buffer overflow was found in libxml2 before version 2.9.11 when processing truncated UTF-8 input.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/235
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3518
- Severity: Medium
- Type: Arbitrary code execution
- Description: A use-after-free security issue was found in libxml2 before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when processing crafted files.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3537
- Severity: Low
- Type: Denial of service
- Description: It was found that libxml2 before version 2.9.11 did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/243
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3541
- Severity: Low
- Type: Denial of service
- Description: A security issue was found in libxml2 before version 2.9.11. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into
DTDLOAD
which is off by default).For more details supporting this analysis of this CVE, please visit #2233.
🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Description
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by
Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".Affected Versions
Nokogiri
<= 1.10.10
as well as prereleases1.11.0.rc1
,1.11.0.rc2
, and1.11.0.rc3
Mitigation
There are no known workarounds for affected versions. Upgrade to Nokogiri
1.11.0.rc4
or later.If, after upgrading to
1.11.0.rc4
or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):
- Ensure the input is trusted. Do not enable this option
for untrusted input.- When invoking the
Nokogiri::XML::Schema
constructor,
pass as the second parameter an instance ofNokogiri::XML::ParseOptions
with the
NONET
flag turned off.So if your previous code was:
# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network # but in v1.11.0.rc4 and later, this call will disallow network access for external resources schema = Nokogiri::XML::Schema.new(schema)# in v1.11.0.rc4 and later, the following is equivalent to the code above # (the second parameter is optional, and this demonstrates its default value) schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
Then you can add the second parameter to indicate that the input is trusted by changing it to:
# in v1.11.0.rc3 and earlier, this would raise an ArgumentError # but in v1.11.0.rc4 and later, this allows resources to be accessed over the network schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 racc (added, 1.6.1)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase
.
All Depfu comment commands
- @depfu rebase
- Rebases against your default branch and redoes this update
- @depfu recreate
- Recreates this PR, overwriting any edits that you've made to it
- @depfu merge
- Merges this PR once your tests are passing and conflicts are resolved
- @depfu close
- Closes this PR and deletes the branch
- @depfu reopen
- Restores the branch and reopens this PR (if it's closed)
- @depfu pause
- Ignores all future updates for this dependency and closes this PR
- @depfu pause [minor|major]
- Ignores all future minor/major updates for this dependency and closes this PR
- @depfu resume
- Future versions of this dependency will create PRs again (leaves this PR as is)