GHSA-v6gp-9mmm-c6p5 Out-of-bounds Write in zlib affects Nokogiri
An out-of-bounds write in the vendored zlib library within Nokogiri allows attackers to cause memory corruption, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v6gp-9mmm-c6p5?
GHSA-v6gp-9mmm-c6p5 is a memory corruption vulnerability in nokogiri, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses CVE-2018-25032. That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.
Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.13.4, and only if the packaged version of zlib is being used. Please see this document for a complete description of which platform gems vendor zlib. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's zlib release announcements.
Mitigation
Upgrade to Nokogiri >= v1.13.4.
Impact
CVE-2018-25032 in zlib
- Severity: High
- Type: CWE-787 Out of bounds write
- Description: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Which versions are affected by GHSA-v6gp-9mmm-c6p5?
2 open source packages ship an affected version, including nokogiri.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.13.4 |
nokogiri RubyGems | All versions | 1.13.4 |
How do I fix GHSA-v6gp-9mmm-c6p5?
Upgrade nokogiri to 1.13.4 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-v6gp-9mmm-c6p5 being exploited?
There is no known exploitation of GHSA-v6gp-9mmm-c6p5 in the wild and no public exploit code.