Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3868 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3868-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     September 03, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : ruby-nokogiri     Version        : 1.11.1+dfsg-2+deb11u1     CVE ID         : CVE-2022-24836     Debian Bug     : 1009787

    A vulnerability was discovered in Nokogiri, an open source XML and HTML     library for Ruby.  An inefficient regular expression was susceptible to     excessive backtracking when attempting to detect encoding in HTML     documents.  This could lead to denial-of-service.

    For Debian 11 bullseye, this problem has been fixed in version     1.11.1+dfsg-2+deb11u1.

    We recommend that you upgrade your ruby-nokogiri packages.

    For the detailed security status of ruby-nokogiri please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-nokogiri

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8506 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):
    * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)
    * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an     unnecessary way (CVE-2021-37137)
    * python3-django: Possible XSS via template tag (CVE-2022-22818)
    * tfm-rubygem-nokogiri: ReDoS in HTML encoding detection (CVE-2022-24836)
    * tfm-rubygem-sinatra: Path traversal possible outside of public_dir when serving static files     (CVE-2022-29970)
    * tfm-rubygem-git: Package vulnerable to Command Injection via git argument injection (CVE-2022-25648)
    * rubygem-rails-html-sanitizer: Possible XSS with certain configurations (CVE-2022-32209)
    * python3-django: Potential SQL injection via Trunc and Extract arguments (CVE-2022-34265)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8506 advisory.

  - The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed     output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are     affected. The malicious input can trigger an OOME and so a DoS attack (CVE-2021-37136)

  - The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory     usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which     may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious     input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable     chunk. (CVE-2021-37137)

  - The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not     properly encode the current context. This may lead to XSS. (CVE-2022-22818)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

  - The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling     the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch     subcommand in a way that additional flags can be set. The additional flags can be used to perform a     command injection. (CVE-2022-25648)

  - Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static     files. (CVE-2022-29970)

  - # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain     configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier     CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS     vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject     content if the application developer has overridden the sanitizer's allowed tags to allow both `select`     and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via     application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags =     [select, style]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may     be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags:
    [select, style] %>```see     https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be     done with Rails::Html::SafeListSanitizer directly:```ruby# class-level     optionRails::Html::SafeListSanitizer.allowed_tags = [select, style]```or```ruby# instance-level     optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [select, style])```All users     overriding the allowed tags by any of the above mechanisms to include both select and style should     either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at     the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.##     CreditsThis vulnerability was responsibly reported by     [windshock](https://hackerone.com/windshock?type=user). (CVE-2022-32209)

  - An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract()     database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value.
    Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
    (CVE-2022-34265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.1. It is, therefore, affected by multiple vulnerabilities:

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-     check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause     illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch     for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or     equivalent. (CVE-2022-29181)

  - The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS     Ventura 13.1. Visiting a website that frames malicious content may lead to UI spoofing. (CVE-2022-32919)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS     Ventura 13.1, macOS Big Sur 11.7.2. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2022-32942)

  - The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.
    (CVE-2022-32943)

  - When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control     codes that when later are sent back to a HTTPserver might make the server return 400 responses.
    Effectively allowing asister site to deny service to all siblings. (CVE-2022-35252)

  - An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This     issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, watchOS 9.2.
    A remote user may be able to cause unexpected app termination or arbitrary code execution.
    (CVE-2022-42837)

  - This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2     and iPadOS 16.2, macOS Ventura 13.1. An app may be able to read sensitive location information.
    (CVE-2022-42839)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS     Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be     able to execute arbitrary code with kernel privileges. (CVE-2022-42840)

  - A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2,     macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a maliciously crafted package may lead to arbitrary     code execution. (CVE-2022-42841)

  - The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey     12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. A remote user may     be able to cause kernel code execution. (CVE-2022-42842)

  - This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may be able to view sensitive user information.
    (CVE-2022-42843)

  - The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey     12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app with root     privileges may be able to execute arbitrary code with kernel privileges. (CVE-2022-42845)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS     Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges. (CVE-2022-42847)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2,     macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing     maliciously crafted web content may result in the disclosure of process memory. (CVE-2022-42852)

  - An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura     13.1. An app may be able to modify protected parts of the file system. (CVE-2022-42853)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS     Ventura 13.1. An app may be able to disclose kernel memory. (CVE-2022-42854)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS     Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be     able to use arbitrary entitlements. (CVE-2022-42855)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2,     tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted     web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been     actively exploited against versions of iOS released before iOS 15.1.. (CVE-2022-42856)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS     Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges (CVE-2022-42858)

  - Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS     16.2, macOS Ventura 13.1, watchOS 9.2. An app may be able to bypass Privacy preferences. (CVE-2022-42859)

  - This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS     Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2. An app may be able to break out of its     sandbox. (CVE-2022-42861)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1. An app may be able to bypass Privacy preferences. (CVE-2022-42862)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in Safari     16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2022-42863, CVE-2022-46699)

  - A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS     Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and     iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2022-42864)

  - This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to bypass Privacy preferences.
    (CVE-2022-42865)

  - The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to read sensitive location information.
    (CVE-2022-42866)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2,     tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2022-42867)

  - A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS     Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and     iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2022-46689)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2     and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code     with kernel privileges. (CVE-2022-46690)

  - A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari     16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2022-46691)

  - A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2,     iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2,     watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy. (CVE-2022-46692)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS     16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing a     maliciously crafted file may lead to arbitrary code execution. (CVE-2022-46693)

  - A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.
    This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS     16.2, watchOS 9.2. Visiting a website that frames malicious content may lead to UI spoofing.
    (CVE-2022-46695)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari     16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2022-46696)

  - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS     Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges. (CVE-2022-46697)

  - A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud     for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously     crafted web content may disclose sensitive user information. (CVE-2022-46698)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari     16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2022-46700)

  - The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution     with kernel privileges. (CVE-2022-46701)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS     15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An app may be able to read sensitive location     information (CVE-2022-46703)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1,     macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to modify protected parts of the file     system. (CVE-2022-46704)

  - A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.
    This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious     website may lead to address bar spoofing. (CVE-2022-46705)

  - A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS     Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the     Share Sheet. (CVE-2022-46710)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS     16.2 and iPadOS 16.2. Private Relay functionality did not match system settings (CVE-2022-46716)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS     15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to read     sensitive location information (CVE-2022-46718)

  - An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and     iPadOS 16.2, macOS Ventura 13.1. An app may be able to break out of its sandbox (CVE-2022-46720)

  - A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.
    This issue is fixed in iOS 16.4 and iPadOS 16.4. Visiting a malicious website may lead to address bar     spoofing. (CVE-2022-46725)

  - The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS     16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to     bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against     versions of iOS released before iOS 15.7.1. (CVE-2022-48618)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4016-1 advisory.

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-     check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause     illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch     for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or     equivalent. (CVE-2022-29181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4015-1 advisory.

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-     check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause     illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch     for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or     equivalent. (CVE-2022-29181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3149 advisory.

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a     subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This     vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by     Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was     addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by     Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network,     potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by     Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed     in Nokogiri version 1.11.0.rc4. (CVE-2020-26247)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-062 advisory.

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-29 (Nokogiri: Multiple Vulnerabilities)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by     Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network,     potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by     Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed     in Nokogiri version 1.11.0.rc4. (CVE-2020-26247)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-     check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause     illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch     for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or     equivalent. (CVE-2022-29181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rubygem18-nokogiri installed on the remote host is prior to 1.5.11-1.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1595 advisory.

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-3003 advisory.

  - Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient     regular expression that is susceptible to excessive backtracking when attempting to detect encoding in     HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for     this issue. (CVE-2022-24836)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206453	Debian dla-3868 : ruby-nokogiri - security update	Nessus	Debian Local Security Checks	high
194188	RHEL 8 : Satellite 6.12 Release (Important) (RHSA-2022:8506)	Nessus	Red Hat Local Security Checks	critical
184617	Rocky Linux 8 : Satellite 6.12 Release (Important) (RLSA-2022:8506)	Nessus	Rocky Linux Local Security Checks	critical
168697	macOS 13.x < 13.1 Multiple Vulnerabilities (HT213532)	Nessus	MacOS X Local Security Checks	critical
167761	SUSE SLED15 / SLES15 Security Update : rubygem-nokogiri (SUSE-SU-2022:4016-1)	Nessus	SuSE Local Security Checks	high
167752	SUSE SLED15 / SLES15 Security Update : rubygem-nokogiri (SUSE-SU-2022:4015-1)	Nessus	SuSE Local Security Checks	high
166069	Debian DLA-3149-1 : ruby-nokogiri - LTS security update	Nessus	Debian Local Security Checks	critical
164747	Amazon Linux 2022 : rubygem-nokogiri (ALAS2022-2022-062)	Nessus	Amazon Linux Local Security Checks	high
164110	GLSA-202208-29 : Nokogiri: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
162003	Amazon Linux AMI : rubygem-nokogiri, rubygem18-nokogiri (ALAS-2022-1595)	Nessus	Amazon Linux Local Security Checks	high
161199	Debian DLA-3003-1 : ruby-nokogiri - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-24836

high

Tenable Plugins

high

critical

critical

critical

high

high

critical

high

high

high

high