Asymmetric denial of service In nokogiri
Description
Nokogiri NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel7 | 0:2.9.1-6.el7.4 | ||
 rubygems | 1.8.5 | ||
 alpine v3.13 | 2.9.8-r1 | ||
 debian 12 | 2.9.10+dfsg-2 | ||
alpine v3.18 | 2.9.8-r1 | ||
alpine v3.5 | 2.9.8-r1 | ||
alpine v3.7 | 2.9.8-r1 | ||
debian 14 | 2.9.10+dfsg-2 | ||
alpine v3.10 | 2.9.8-r1 | ||
alpine v3.11 | 2.9.8-r1 |
1-10 of 30
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
References
1. 2. 3. 4. 5. 6. 7. 8.