Notice: incorrect dependabot security advisory for Nokogiri re: CVE-2017-15412

[flavorjones]

Yesterday an incorrect GHSA was processed by dependabot sending out incorrect security warnings.

The version numbers in the original report are incorrect. They are the version of the underlying libxml2 library, and not the version of the Nokogiri gem. The correct version that a patched version of libxml2 appears in is Nokogiri 1.8.2.

See:

• Investigate Ubuntu libxml2 patches in USN-3504-1, USN-3504-2, USN-3513-1, USN-3513-2 #1714
• https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md#182--2018-01-29
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml

I have submitted a request to have this fixed to github: github/advisory-database#2660

🤷

[flavorjones]

The advisory-database data has been corrected.