WS-2022-0334 (Medium) detected in nokogiri-1.13.6-x86_64-linux.gem - autoclosed
mend-for-github-com opened this issue · comments
WS-2022-0334 - Medium Severity Vulnerability
Vulnerable Library - nokogiri-1.13.6-x86_64-linux.gem
Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).
Library home page: https://rubygems.org/gems/nokogiri-1.13.6-x86_64-linux.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /.7.0/cache/nokogiri-1.13.6-x86_64-linux.gem
Dependency Hierarchy:
- ❌ nokogiri-1.13.6-x86_64-linux.gem (Vulnerable Library)
Found in base branch: master
Vulnerability Details
nokogiri up to and including 1.13.8 is affected by several vulnerabilities (CVE-2022-40303, CVE-2022-40304 and CVE-2022-2309) in the dependency bundled libxml2 library. Version 1.13.9 of nokogiri contains a patch where the dependency is upgraded with the patches as well.
Publish Date: 2022-10-18
URL: WS-2022-0334
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-2qc6-mcvw-92cw
Release Date: 2022-10-18
Fix Resolution: nokogiri - 1.13.9
- Check this box to open an automated fix PR
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.