A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3149 advisory.

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a     subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This     vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by     Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was     addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by     Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network,     potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by     Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed     in Nokogiri version 1.11.0.rc4. (CVE-2020-26247)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3150 advisory.

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a     subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This     vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by     Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was     addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the rubygem package has been released.

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a     subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This     vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by     Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was     addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by     Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network,     potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by     Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed     in Nokogiri version 1.11.0.rc4. (CVE-2020-26247)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users     of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
    Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser,     Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias     Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a     patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not     affected. (CVE-2021-41098)

This update for rubygem-nokogiri fixes the following issues:
rubygem-nokogiri was updated to 1.8.5 (bsc#1156722).

Security issues fixed :

  - CVE-2019-5477: Fixed a command injection vulnerability     (bsc#1146578).

  - CVE-2020-26247: Fixed an XXE vulnerability in     Nokogiri::XML::Schema (bsc#1180507).

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202006-05 (Nokogiri: Command injection)

    A command injection vulnerability in Nokogiri allows commands to be       executed in a subprocess by Ruby&rsquo;s Kernel.open method. Processes are       vulnerable only if the undocumented method       Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    Avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file       with untrusted user input.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4175-1 advisory.

    It was discovered that Nokogiri incorrectly handled inputs. A remote attacker could possibly use this     issue to execute arbitrary OS commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Ruby's `Kernel.open` method.

For Debian 8 'Jessie', this problem has been fixed in version 1.6.3.1+ds-1+deb8u1.

We recommend that you upgrade your ruby-nokogiri packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nokogiri GitHub release :

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

ID	Name	Product	Family	Severity
166069	Debian DLA-3149-1 : ruby-nokogiri - LTS security update	Nessus	Debian Local Security Checks	critical
166068	Debian DLA-3150-1 : rexical - LTS security update	Nessus	Debian Local Security Checks	critical
155347	Photon OS 2.0: Rubygem PHSA-2021-2.0-0413	Nessus	PhotonOS Local Security Checks	critical
146274	openSUSE Security Update : rubygem-nokogiri (openSUSE-2021-237)	Nessus	SuSE Local Security Checks	critical
137442	GLSA-202006-05 : Nokogiri: Command injection	Nessus	Gentoo Local Security Checks	critical
130588	Ubuntu 16.04 LTS / 18.04 LTS : Nokogiri vulnerability (USN-4175-1)	Nessus	Ubuntu Local Security Checks	critical
129363	Debian DLA-1933-1 : ruby-nokogiri security update	Nessus	Debian Local Security Checks	critical
127876	FreeBSD : Nokogiri -- injection vulnerability (0569146e-bdef-11e9-bd31-8de4a4470bbb)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-5477

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical