-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 11 Oct 2022 19:39:06 +0200 Source: ruby-nokogiri Architecture: source Version: 1.10.0+dfsg1-2+deb10u1 Distribution: buster-security Urgency: high Maintainer: Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org> Changed-By: Sylvain Beucler <beuc@debian.org> Closes: 934802 978967 1009787 Changes: ruby-nokogiri (1.10.0+dfsg1-2+deb10u1) buster-security; urgency=high . * Non-maintainer upload by the LTS Security Team. * CVE-2019-5477: command injection vulnerability allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. (Closes: #934802) * CVE-2020-26247: XXE vulnerability: XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. (Closes: #978967) * CVE-2022-24836: Nokogiri contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. (Closes: #1009787) Checksums-Sha1: 19d051a68d9a2f76f66435abf7436c6a6f74d5cc 2289 ruby-nokogiri_1.10.0+dfsg1-2+deb10u1.dsc 534b8ad0333f6e3d44f06c141f4579cf2681ee2c 447908 ruby-nokogiri_1.10.0+dfsg1.orig.tar.xz 015d0329704a11f2fb2cfc8f048073fc78e5279b 14284 ruby-nokogiri_1.10.0+dfsg1-2+deb10u1.debian.tar.xz 4d4d41e64cc145826f9761dd1457a135c779ef99 9458 ruby-nokogiri_1.10.0+dfsg1-2+deb10u1_amd64.buildinfo Checksums-Sha256: 5e1e818634b9b6234e207e3c9806d8100466343a3ce3d8e8cf8fb7611fe72a16 2289 ruby-nokogiri_1.10.0+dfsg1-2+deb10u1.dsc 0d6f82906605169e50087fcc67789b3962916d60eb8a54d113b1ccdc5a51c043 447908 ruby-nokogiri_1.10.0+dfsg1.orig.tar.xz d7c956504a23e72be419dff26c8dd34413d89e5e9d8103bd27426b2cc58113a4 14284 ruby-nokogiri_1.10.0+dfsg1-2+deb10u1.debian.tar.xz 7a82c86a3133453fb27aaae662c4edf41f6923857fe160fc05be1a280bd276f7 9458 ruby-nokogiri_1.10.0+dfsg1-2+deb10u1_amd64.buildinfo Files: 9f400cabc21d3cdf19271182f88f77c4 2289 ruby optional ruby-nokogiri_1.10.0+dfsg1-2+deb10u1.dsc 7c2b60f530dce00727c1c19ff0a48b58 447908 ruby optional ruby-nokogiri_1.10.0+dfsg1.orig.tar.xz 69dd35b03568e41a9b929f8aab62cfc5 14284 ruby optional ruby-nokogiri_1.10.0+dfsg1-2+deb10u1.debian.tar.xz 5c818a556dda7c6e332bfbe8dc00690b 9458 ruby optional ruby-nokogiri_1.10.0+dfsg1-2+deb10u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmNGwTAACgkQDTl9HeUl XjDh7Q//apBhI2OxcoXD/rFTeXTbsJvKqUf1nKOLYb2pE/fiSS46cS2zUFHWsStj jWiZW62gR1WdTgBVRzeouYCqVjUWGTCJy6TxMHtTOstUMmbdbBaVAq/eIW4rTwOi u4falBIc1uMEN/+gmGHGoMuJ5j/RDLc8Ra+xLUMlI5ZjNd3JdLOe04LvSRtpBVAK XqHbEsQe/t+Q8MhKAYunirHsXFHEAqwIaNIQBrpeXa7PA0TMIpzRj3vmk6T/d4qZ Judkd60F9MNGoI/eUqCsxjdMOO8pQvnBj2/WaelZkqFCs5B94kTaO623xE1OTXnK /MP1vdHXh+VkDelk5gVHpvtKSdO/KDIMen+eUJdzpKUGrT9pcncIzMl371oUMkHw J9qU7+O19BrMwuihL8GQYek0VwoTprw2ijnwVqVWJItog3o4D2ittjyJXq4RA3Yt E4gi+Se2OlTW3g18RhmwKhMOB/miKoS4SA9CrdNFaGzS9Jrx/PzB/2OYjOqB4RhJ TsLyN4dUN/GD1GWDLyvIrx3ZduErhkrhMr2RIftMz6z6hC143Cy35HNYBOlPUszN VsnZezySYHHUIzy9/Zk94ytyswNxG7mHdqgQdnYqEXA0KIvDgn5seGdUQHuYSQZ8 /rFcKIsPsoQtDmotSPlpX0nCnTKf9yGEVefdpGenW2QTJgPL4Zc= =O4ke -----END PGP SIGNATURE-----
