CVE-2022-29181 : Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all input

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

Published 2022-05-20 19:15:08

Updated 2023-02-16 02:31:15

Source GitHub, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-29181

EPSS FAQ

0.37%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-29181

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	3.9	4.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: High
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	3.9	4.2	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: High

CWE ids for CVE-2022-29181

CWE-241 Improper Handling of Unexpected Data Type

The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

Assigned by: security-advisories@github.com (Primary)

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Assigned by: nvd@nist.gov (Secondary)

References for CVE-2022-29181

http://seclists.org/fulldisclosure/2022/Dec/23

Full Disclosure: APPLE-SA-2022-12-13-4 macOS Ventura 13.1
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6

Release 1.13.6 / 2022-05-08 · sparklemotion/nokogiri · GitHub
Release Notes;Third Party Advisory
https://security.gentoo.org/glsa/202208-29

Nokogiri: Multiple Vulnerabilities (GLSA 202208-29) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://support.apple.com/kb/HT213532

About the security content of macOS Ventura 13.1 - Apple Support
Third Party Advisory

CVEs referencing this url
https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/

GHSL-2022-031_GHSL-2022-032: Type confusion in Nokogiri leads to memory leak or DoS - CVE-2022-29181 | GitHub Security Lab
Exploit;Third Party Advisory
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m

Improper Handling of Unexpected Data Type in Nokogiri · Advisory · sparklemotion/nokogiri · GitHub
Issue Tracking;Third Party Advisory
https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267

fix: {HTML4,XML}::SAX::{Parser,ParserContext} check arg types · sparklemotion/nokogiri@db05ba9 · GitHub
Patch;Third Party Advisory

Products affected by CVE-2022-29181

Apple » Macos
Versions from including (>=) 13.0 and before (<) 13.1
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Matching versions
Nokogiri » Nokogiri » For Ruby
Versions before (<) 1.13.6
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*
Matching versions

Vulnerability Details : CVE-2022-29181

Exploit prediction scoring system (EPSS) score for CVE-2022-29181

CVSS scores for CVE-2022-29181

CWE ids for CVE-2022-29181

References for CVE-2022-29181

Products affected by CVE-2022-29181