Loading...
Skip to main content
GeekWala

CVE-2021-3517

HIGH

Nokogiri contains libxml Out-of-bounds Write vulnerability

Published May 24, 2022Updated March 8, 2024Source: osv

Summary

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update nokogiri to 1.11.4 or later
gem install nokogiri -v 1.11.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

PackageEcosystemAffectedFixed In
nokogiri
rubygems
1.0.0, 1.0.1, 1.0.2, 1.0.3 (+124 more)1.11.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-787
    Out-of-bounds WriteMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.6 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

Frequently Asked Questions

What is CVE-2021-3517?
Nokogiri contains libxml Out-of-bounds Write vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.6/10).
How do I check if my project is affected by CVE-2021-3517?
CVE-2021-3517 affects nokogiri. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-3517 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.6

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-jw9f-hh49-cvp9

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies