CVE-2021-41098 — Vulnetix

CVE-2021-41098 PUBLISHED CVSS 7.5 HIGH

Reported by GitHub_M · Published September 27, 2021

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.

Risk Scores

CVSS v3.0

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
sparklemotion	nokogiri	< 1.12.5
RubyGems	nokogiri	0, 0
sparklemotion	nokogiri	,

Timeline

Sep 27, 2021 CVE Published
Sep 28, 2021 EPSS Score
Oct 6, 2021 CVE Updated
Nov 23, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Mar 16, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 12, 2022 EPSS Score
Jul 7, 2022 EPSS Score
Oct 29, 2022 EPSS Score
Dec 25, 2022 EPSS Score

References

x_refsource_CONFIRM
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2021-41098 advisory

Open in Interactive Console →