Is CVE-2019-13117 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-13117 being exploited in the wild.

How severe is CVE-2019-13117?

Medium severity, with a CVSS score of 5.3, published 24 May 2022.

Which products and versions are affected?

Gnome Libxslt 1.1.33; nokogiri (RubyGems) < 1.10.5, ECOSYSTEM:introduced=0,fixed=1.10.5.

Is there a fix for CVE-2019-13117?

Yes. nokogiri (RubyGems): upgrade to 1.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-13117 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-13117?

Check whether you run Gnome Libxslt or nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-13117: Nokogiri uninitialized read in libxslt xsl:number processing

Q: Is there a fix for CVE-2019-13117?

Yes. nokogiri (RubyGems): upgrade to 1.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2019-13117 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2019-13117?

Check whether you run Gnome Libxslt or nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-13117 · Severity: medium · CVSS 5.3 · Published 2022-05-24

Nokogiri is a popular Ruby library used for parsing and processing XML and HTML documents. A security flaw in its underlying processing engine could allow an attacker to read small amounts of sensitive information from the server's memory by providing specially crafted formatting strings. This could potentially lead to the exposure of internal data or help an attacker bypass other security measures.

Technologies: Gnome Libxslt, nokogiri (RubyGems). Vendors: Gnome, RubyGems.

Quick answers

Is CVE-2019-13117 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-13117 being exploited in the wild.
How severe is CVE-2019-13117?: Medium severity, with a CVSS score of 5.3, published 24 May 2022.
Which products and versions are affected?: Gnome Libxslt 1.1.33; nokogiri (RubyGems) < 1.10.5, ECOSYSTEM:introduced=0,fixed=1.10.5.
Is there a fix for CVE-2019-13117?: Yes. nokogiri (RubyGems): upgrade to 1.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-13117 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-13117?: Check whether you run Gnome Libxslt or nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nokogiri (RubyGems): upgrade to 1.10.5 or later
```
bundle update nokogiri
```

Technical details

An uninitialized read vulnerability exists in libxslt (specifically in numbers.c) when processing xsl:number instructions with certain format strings. The root cause is located in the xsltNumberFormatInsertNumbers function, where a failure to initialize resources allows an attacker to infer the contents of bytes on the stack (such as identifying specific characters like 'A', 'a', 'I', 'i', or '0'). This is a network-reachable vulnerability requiring no authentication or user interaction. While the information leak is limited in scope per request, it can be used to bypass memory protections or leak sensitive stack data. The issue is addressed in Nokogiri version 1.10.5 by updating the bundled libxslt dependency.

Affected products

Nokogiri Nokogiri < 1.10.5
GNOME libxslt 1.1.33

Identifiers

CVE-2019-13117
GHSA-4hm9-844j-jmxp

Timeline

2019-07-01: disclosed: NVD publication date
2019-10-22: patched: Nokogiri v1.10.5 released with fix
2022-05-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.