Security update for rubygem-nokogiri SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0210-1 Final 1 1 2021-01-25T15:26:23Z current 2021-01-25T15:26:23Z 2021-01-25T15:26:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-nokogiri This update for rubygem-nokogiri fixes the following issues: - CVE-2019-5477: Fixed a command injection vulnerability (bsc#1146578). - CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema (bsc#1180507). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-210,SUSE-OpenStack-Cloud-7-2021-210,SUSE-OpenStack-Cloud-Crowbar-8-2021-210,SUSE-OpenStack-Cloud-Crowbar-9-2021-210 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210210-1/ Link for SUSE-SU-2021:0210-1 https://lists.suse.com/pipermail/sle-security-updates/2021-January/008244.html E-Mail link for SUSE-SU-2021:0210-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1146578 SUSE Bug 1146578 https://bugzilla.suse.com/1180507 SUSE Bug 1180507 https://www.suse.com/security/cve/CVE-2019-5477/ SUSE CVE CVE-2019-5477 page https://www.suse.com/security/cve/CVE-2020-26247/ SUSE CVE CVE-2020-26247 page SUSE OpenStack Cloud 7 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 ruby2.1-rubygem-nokogiri-doc-1.6.1-5.3.1 ruby2.1-rubygem-nokogiri-testsuite-1.6.1-5.3.1 ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 as a component of SUSE OpenStack Cloud Crowbar 8 ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. CVE-2019-5477 SUSE OpenStack Cloud 7:ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 SUSE OpenStack Cloud Crowbar 8:ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 SUSE OpenStack Cloud Crowbar 9:ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210210-1/ https://www.suse.com/security/cve/CVE-2019-5477.html CVE-2019-5477 https://bugzilla.suse.com/1146578 SUSE Bug 1146578 Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4. CVE-2020-26247 SUSE OpenStack Cloud 7:ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 SUSE OpenStack Cloud Crowbar 8:ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 SUSE OpenStack Cloud Crowbar 9:ruby2.1-rubygem-nokogiri-1.6.1-5.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210210-1/ https://www.suse.com/security/cve/CVE-2020-26247.html CVE-2020-26247 https://bugzilla.suse.com/1180507 SUSE Bug 1180507