Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🚨 [security] Update nokogiri: 1.8.4 → 1.8.5 (patch) #112

Merged
merged 1 commit into from
Oct 5, 2018

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Oct 5, 2018


🚨 Your version of nokogiri has known security vulnerabilities 🚨

Advisory: CVE-2018-14404
Disclosed: October 04, 2018
URL: https://github.com/sparklemotion/nokogiri/issues/1785

Nokogiri gem, via libxml2, is affected by multiple vulnerabilities

Nokogiri 1.8.5 has been released.

This is a security and bugfix release. It addresses two CVEs in upstream
libxml2 rated as "medium" by Red Hat, for which details are below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that these patches are not
yet (as of 2018-10-04) in an upstream release of libxml2.

Full details about the security update are available in Github Issue #1785.
[#1785]: #1785


[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
and CVE-2018-14567. Full details are available in #1785. Note that these
patches are not yet (as of 2018-10-04) in an upstream release of libxml2.


CVE-2018-14404

Permalink:

https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html

Description:

A NULL pointer dereference vulnerability exists in the
xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
case. Applications processing untrusted XSL format inputs with the use of
the libxml2 library may be vulnerable to a denial of service attack due
to a crash of the application

Canonical rates this vulnerability as "Priority: Medium"


CVE-2018-14567

Permalink:

https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html

Description:

infinite loop in LZMA decompression

Canonical rates this vulnerability as "Priority: Medium"


🚨 We recommend to merge and deploy this update as soon as possible! 🚨

We've updated a dependency and here is what you need to know:

name version specification old version new version
nokogiri indirect dependency 1.8.4 1.8.5

You should probably take a good look at the info here and the test results before merging this pull request, of course.

What changed?

↗️ nokogiri (indirect, 1.8.4 → 1.8.5) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 11 commits:


Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.

@depfu depfu bot added the depfu label Oct 5, 2018
@joenas joenas merged commit 40a0c82 into master Oct 5, 2018
@depfu depfu bot deleted the depfu/update/nokogiri-1.8.5 branch October 5, 2018 08:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant