CVE-2019-18197: Nokogiri Use After Free in libxslt dependency

CVE-2019-18197 · Severity: high · CVSS 7.5 · Published 2022-05-24

Nokogiri, a popular Ruby library used for parsing and manipulating XML and HTML documents, was found to be using a vulnerable version of the libxslt library. This flaw could allow an attacker to cause a service crash, disclose sensitive information from memory, or potentially execute unauthorized code when the application processes a specially crafted document. Organizations using Nokogiri should update to version 1.10.5 or later to ensure they are using a patched version of the underlying processing engine.

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2019-18197 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-18197 being exploited in the wild.
How severe is CVE-2019-18197?
High severity, with a CVSS score of 7.5, published 24 May 2022.
Which products and versions are affected?
nokogiri (RubyGems) < 1.10.5, ECOSYSTEM:introduced=0,fixed=1.10.5.
Is there a fix for CVE-2019-18197?
Yes. nokogiri (RubyGems): upgrade to 1.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-18197 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2019-18197?
Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nokogiri (RubyGems): upgrade to 1.10.5 or later
    bundle update nokogiri

Technical details

Nokogiri versions prior to 1.10.5 bundle libxslt 1.1.33, which contains a vulnerability in the `xsltCopyText` function within `transform.c`. The issue stems from a pointer variable not being properly reset under specific conditions, leading to a use-after-free or use of an uninitialized resource (CWE-416, CWE-908). An attacker can exploit this by providing a malicious XSLT stylesheet or XML document that triggers specific memory reuse patterns. Successful exploitation can result in a failed bounds check, allowing for out-of-bounds writes or the disclosure of uninitialized memory contents. The vulnerability is addressed in Nokogiri 1.10.5 by upgrading the bundled libxslt to version 1.1.34.

Affected products

  • Nokogiri Nokogiri < 1.10.5

Identifiers

  • CVE-2019-18197
  • GHSA-242x-7cm6-4w8j

Timeline

  • 2019-10-18: disclosed: NVD publication date
  • 2022-05-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.