Nokogiri security update v1.11.4

Nokogiri v1.11.4 was released on 2021-05-14, which contains an updated
version of libxml2 that addresses several upstream CVEs.

These CVEs are fully described at
Update packaged libxml2 from 2.9.10 to 2.9.12 · Advisory · sparklemotion/nokogiri · GitHub.
That security advisory is reproduced here for your convenience.

···

---

Summary

Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which
addresses:

   - CVE-2019-20388 <CVE-2019-20388 - libxml2 - Arch Linux> (Medium
   severity)
   - CVE-2020-24977 <CVE-2020-24977 - libxml2 - Arch Linux> (Medium
   severity)
   - CVE-2021-3517 <CVE-2021-3517 - libxml2 - Arch Linux> (Medium
   severity)
   - CVE-2021-3518 <CVE-2021-3518 - libxml2 - Arch Linux> (Medium
   severity)
   - CVE-2021-3537 <CVE-2021-3537 - libxml2 - Arch Linux> (Low
   severity)
   - CVE-2021-3541 <CVE-2021-3541 - libxml2 - Arch Linux> (Low
   severity)

Note that two additional CVEs were addressed upstream but are not relevant
to this release. CVE-2021-3516
<CVE-2021-3516 - libxml2 - Arch Linux> via xmllint is not present
in Nokogiri, and CVE-2020-7595
<CVE-2020-7595 - libxml2 - Arch Linux> has been patched in Nokogiri
since v1.10.8 (see #1992
<Investigate libxml2 vulnerabilities patched in USN-4274-1 · Issue #1992 · sparklemotion/nokogiri · GitHub>).

Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being
used. If you've overridden defaults at installation time to use system
libraries instead of packaged libraries, you should instead pay attention
to your distro's libxml2 release announcements.
Mitigation

Upgrade to Nokogiri >= 1.11.4.
Impact

I've done a brief analysis of the published CVEs that are addressed in this
upstream release. The libxml2 maintainers have not released a canonical set
of CVEs, and so this list is pieced together from secondary sources and may
be incomplete.

All information below is sourced from security.archlinux.org, which appears
to have the most up-to-date information as of this analysis.
CVE-2019-20388 <CVE-2019-20388 - libxml2 - Arch Linux>

   - Severity: Medium
   - Type: Denial of service
   - Description: A memory leak was found in the xmlSchemaValidateStream
   function of libxml2. Applications that use this library may be vulnerable
   to memory not being freed leading to a denial of service.
   - Fixed:
   Fix memory leak in xmlSchemaValidateStream (7ffcd44d) · Commits · GNOME / libxml2 · GitLab

Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2020-7595 <CVE-2020-7595 - libxml2 - Arch Linux>

   - Severity: Medium
   - Type: Denial of service
   - Description: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10
   has an infinite loop in a certain end-of-file situation.
   - Fixed:
   https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5

This has been patched in Nokogiri since v1.10.8 (see #1992
<Investigate libxml2 vulnerabilities patched in USN-4274-1 · Issue #1992 · sparklemotion/nokogiri · GitHub>).
CVE-2020-24977 <CVE-2020-24977 - libxml2 - Arch Linux>

   - Severity: Medium
   - Type: Information disclosure
   - Description: GNOME project libxml2 <= 2.9.10 has a global buffer
   over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
   - Fixed:
   Fix out-of-bounds read with 'xmllint --htmlout' (50f06b3e) · Commits · GNOME / libxml2 · GitLab

Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3516 <CVE-2021-3516 - libxml2 - Arch Linux>

   - Severity: Medium
   - Type: Arbitrary code execution (no remote vector)
   - Description: A use-after-free security issue was found libxml2 before
   version 2.9.11 when "xmllint --html --push" is used to process crafted
   files.
   - Issue: heap-use-after-free in entities.c:621 (#230) · Issues · GNOME / libxml2 · GitLab
   - Fixed:
   Fix use-after-free with `xmllint --html --push` (1358d157) · Commits · GNOME / libxml2 · GitLab

Verified that the fix commit first appears in v2.9.11. This vector does not
exist within Nokogiri, which does not ship xmllint.
CVE-2021-3517 <CVE-2021-3517 - libxml2 - Arch Linux>

   - Severity: Medium
   - Type: Arbitrary code execution
   - Description: A heap-based buffer overflow was found in libxml2 before
   version 2.9.11 when processing truncated UTF-8 input.
   - Issue: heap-buffer-overflow in entities.c:621 (#235) · Issues · GNOME / libxml2 · GitLab
   - Fixed:
   Validate UTF8 in xmlEncodeEntities (bf227135) · Commits · GNOME / libxml2 · GitLab

Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3518 <CVE-2021-3518 - libxml2 - Arch Linux>

   - Severity: Medium
   - Type: Arbitrary code execution
   - Description: A use-after-free security issue was found in libxml2
   before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when
   processing crafted files.
   - Issue: heap-use-after-free in xinclude.c:2433 (#237) · Issues · GNOME / libxml2 · GitLab
   - Fixed:
   Fix user-after-free with `xmllint --xinclude --dropdtd` (1098c30a) · Commits · GNOME / libxml2 · GitLab

Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3537 <CVE-2021-3537 - libxml2 - Arch Linux>

   - Severity: Low
   - Type: Denial of service
   - Description: It was found that libxml2 before version 2.9.11 did not
   propagate errors while parsing XML mixed content, causing a NULL
   dereference. If an untrusted XML document was parsed in recovery mode and
   post-validated, the flaw could be used to crash the application.
   - Issue: CWE-476 NULL pointer dereference in valid.c:729 in xmlValidBuildAContentModel (#243) · Issues · GNOME / libxml2 · GitLab
   - Fixed:
   https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61

Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3541 <CVE-2021-3541 - libxml2 - Arch Linux>

   - Severity: Low
   - Type: Denial of service
   - Description: A security issue was found in libxml2 before version
   2.9.11. Exponential entity expansion attack its possible bypassing all
   existing protection mechanisms and leading to denial of service.
   - Fixed:
   https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e

Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4,
however Nokogiri's default parse options prevent the attack from succeeding
(it is necessary to opt into DTDLOAD which is off by default).