CVE-2017-16932 Nokogiri gem, via libxml, is affected by DoS vulnerabilities
An attacker can cause a denial of service via infinite recursion in libxml2 parameter entity parsing, affecting applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16932?
CVE-2017-16932 is a high-severity denial of service vulnerability in Xmlsoft Libxml2, published on 23 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Weakness: CWE-835
Which versions are affected by CVE-2017-16932?
2 open source packages ship an affected version, including nokogiri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.8.1 |
nokogiri RubyGems | All versions | 1.8.1 |
Products include Xmlsoft Libxml2.
How do I fix CVE-2017-16932?
Upgrade nokogiri to 1.8.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-16932 being exploited?
There is no known exploitation of CVE-2017-16932 in the wild and no public exploit code.
Other vulnerabilities in Xmlsoft Libxml2
Sources
Also known as ALPINE-CVE-2017-16932, CLEANSTART-2026-ZZ43930, DEBIAN-CVE-2017-16932, ECHO-4ae1-cce4-b9d4, GHSA-x2fm-93ww-ggvx, UBUNTU-CVE-2017-16932 and 1 more.