Junglewise Threat Intelligence

CVE-2019-13117: Nokogiri uninitialized read in libxslt xsl:number processing

CVE-2019-13117 · Severity: medium · CVSS 5.3 · Published 2022-05-24

Technologies: nokogiri (RubyGems), Gnome Libxslt. Vendors: RubyGems, Gnome.

Executive brief

Nokogiri is a popular Ruby library used for parsing and processing XML and HTML documents. A security flaw in its underlying processing engine could allow an attacker to read small amounts of sensitive information from the server's memory by providing specially crafted formatting strings. This could potentially lead to the exposure of internal data or help an attacker bypass other security measures.

Technical details

An uninitialized read vulnerability exists in libxslt (specifically in numbers.c) when processing xsl:number instructions with certain format strings. The root cause is located in the xsltNumberFormatInsertNumbers function, where a failure to initialize resources allows an attacker to infer the contents of bytes on the stack (such as identifying specific characters like 'A', 'a', 'I', 'i', or '0'). This is a network-reachable vulnerability requiring no authentication or user interaction. While the information leak is limited in scope per request, it can be used to bypass memory protections or leak sensitive stack data. The issue is addressed in Nokogiri version 1.10.5 by updating the bundled libxslt dependency.

Affected products

  • Nokogiri Nokogiri < 1.10.5
  • GNOME libxslt 1.1.33

Timeline

  • 2019-07-01: disclosed: NVD publication date
  • 2019-10-22: patched: Nokogiri v1.10.5 released with fix
  • 2022-05-24: advisory: GitHub Advisory published

References

Related threats