CVE-2022-29181

Katalog CVE

CVSS 8.2 · High EPSS 3,2%

Kerentanan Improper Handling of Unexpected Data Type pada nokogiri, apple macos. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

Rincian

Terbit di NVD

20 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-241: Improper Handling of Unexpected Data Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267 patch · advisory pihak ketiga
• https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6 release notes · advisory pihak ketiga
• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m issue tracking · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/Dec/23 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-29 advisory pihak ketiga
• https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/ exploit · advisory pihak ketiga
• https://support.apple.com/kb/HT213532 advisory pihak ketiga
• https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7
• https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri