Nokogiri security update v1.10.3

ruby-talk
1

Nokogiri v1.10.3 has been released.

This is a security release. It addresses a CVE in upstream libxslt rated as
"Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
details are available below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that this patch is not yet
(as of 2019-04-22) in an upstream release of libxslt.

Full details about the security update are available in Github Issue
[#1892].

  [#1892]: https://github.com/sparklemotion/nokogiri/issues/1892

···

---

## 1.10.3 / 2019-04-22

### Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068.
Full details are available in [#1892](
Issues · sparklemotion/nokogiri · GitHub). Note that this
patch is not yet (as of 2019-04-22) in an upstream release of libxslt.

---

CVE-2019-11068

Permalinks are:
- Canonical:

- Debian: CVE-2019-11068

Description:

libxslt through 1.1.33 allows bypass of a protection mechanism
because callers of xsltCheckRead and xsltCheckWrite permit access
even upon receiving a -1 error code. xsltCheckRead can return -1 for
a crafted URL that is not actually invalid and is subsequently
loaded.

Canonical rates this as "Priority: Medium".

Debian rates this as "NVD Severity: High (attack range: remote)".

2

Nokogiri v1.10.3 has been released.

This is a security release. It addresses a CVE in upstream libxslt rated
as "Priority: medium" by Canonical, and "NVD Severity: high" by Debian.
More details are available below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that this patch is not yet
(as of 2019-04-22) in an upstream release of libxslt.

Full details about the security update are available in Github Issue
[#1892].

  [#1892]: https://github.com/sparklemotion/nokogiri/issues/1892

---

## 1.10.3 / 2019-04-22

### Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068.
Full details are available in [#1892](
Issues · sparklemotion/nokogiri · GitHub). Note that this
patch is not yet (as of 2019-04-22) in an upstream release of libxslt.

---

CVE-2019-11068

Permalinks are:
- Canonical:
CVE-2019-11068 | Ubuntu
- Debian: CVE-2019-11068

Description:

> libxslt through 1.1.33 allows bypass of a protection mechanism
> because callers of xsltCheckRead and xsltCheckWrite permit access
> even upon receiving a -1 error code. xsltCheckRead can return -1 for
> a crafted URL that is not actually invalid and is subsequently
> loaded.

Canonical rates this as "Priority: Medium".

Debian rates this as "NVD Severity: High (attack range: remote)".

Unsubscribe: <mailto:ruby-talk-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk&gt;

···

On Tue, 23 Apr 2019 at 3:12 am, Mike Dalessio <mike.dalessio@gmail.com> wrote:
--
Regards,
Luke Hamilton
Serverless Solutions Developer

3

Florian, thanks for the clarification.

NVD indicates that this is a CVSS v3.0 severity "9.8: Critical".

Here are permalinks:

   - NVD entry:
   NVD - CVE-2019-11068
   - expanded CVSS 3.0 score:
   NVD - CVSS v3 Calculator

-m

···

On Tue, Apr 23, 2019 at 5:00 AM Florian Weimer <fweimer@redhat.com> wrote:

* Mike Dalessio:

> This is a security release. It addresses a CVE in upstream libxslt rated
as
> "Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
> details are available below.

Note that the Debian security tracker only relays what NVD provides in
this field. It is not updated if a separate review yields different
results.

Thanks,
Florian