A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a
    subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method
    `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This
    vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by
    Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was
    addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3149 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3149-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     October 12, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby-nokogiri     Version        : 1.10.0+dfsg1-2+deb10u1     CVE ID         : CVE-2019-5477 CVE-2020-26247 CVE-2022-24836     Debian Bug     : 934802 978967 1009787

    Multiple vulnerabilities were discovered in Nokogiri, an     HTML/XML/SAX/Reader parser for the Ruby programming language, leading     to command injection, XML external entity injection (XXE), and     denial-of-service (DoS).

    CVE-2019-5477

        A command injection vulnerability allows commands to be executed         in a subprocess via Ruby's `Kernel.open` method. Processes are         vulnerable only if the undocumented method         `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe         user input as the filename. This vulnerability appears in code         generated by the Rexical gem versions v1.0.6 and earlier. Rexical         is used by Nokogiri to generate lexical scanner code for parsing         CSS queries.

    CVE-2020-26247

        XXE vulnerability: XML Schemas parsed by Nokogiri::XML::Schema are         trusted by default, allowing external resources to be accessed         over the network, potentially enabling XXE or SSRF attacks. This         behavior is counter to the security policy followed by Nokogiri         maintainers, which is to treat all input as untrusted by default         whenever possible.

    CVE-2022-24836

        Nokogiri contains an inefficient regular expression that is         susceptible to excessive backtracking when attempting to detect         encoding in HTML documents.

    For Debian 10 buster, these problems have been fixed in version     1.10.0+dfsg1-2+deb10u1.

    We recommend that you upgrade your ruby-nokogiri packages.

    For the detailed security status of ruby-nokogiri please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-nokogiri

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3150 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3150-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     October 12, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : rexical     Version        : 1.0.5-2+deb10u1     CVE ID         : CVE-2019-5477     Debian Bug     : 940905

    A command injection vulnerability was found in Rexical, a lexical     scanner generator for the Ruby programming language. Processes are     vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user     input as the filename. This vulnerability appears in code generated by     the Rexical gem.

    For Debian 10 buster, this problem has been fixed in version     1.0.5-2+deb10u1.

    We recommend that you upgrade your rexical packages.

    For the detailed security status of rexical please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/rexical

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the rubygem package has been released.

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a     subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This     vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by     Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was     addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by     Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network,     potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by     Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed     in Nokogiri version 1.11.0.rc4. (CVE-2020-26247)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users     of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
    Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser,     Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias     Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a     patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not     affected. (CVE-2021-41098)

This update for rubygem-nokogiri fixes the following issues:
rubygem-nokogiri was updated to 1.8.5 (bsc#1156722).

Security issues fixed :

  - CVE-2019-5477: Fixed a command injection vulnerability     (bsc#1146578).

  - CVE-2020-26247: Fixed an XXE vulnerability in     Nokogiri::XML::Schema (bsc#1180507).

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202006-05 (Nokogiri: Command injection)

    A command injection vulnerability in Nokogiri allows commands to be       executed in a subprocess by Ruby&rsquo;s Kernel.open method. Processes are       vulnerable only if the undocumented method       Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    Avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file       with untrusted user input.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4175-1 advisory.

    It was discovered that Nokogiri incorrectly handled inputs. A remote attacker could possibly use this     issue to execute arbitrary OS commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Ruby's `Kernel.open` method.

For Debian 8 'Jessie', this problem has been fixed in version 1.6.3.1+ds-1+deb8u1.

We recommend that you upgrade your ruby-nokogiri packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nokogiri GitHub release :

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

ID	Name	Product	Family	Severity
422182	SCA: security update for nokogiri, rexical (GHSA-cr5j-953j-xw5p)	Tenable Cloud Security	SCA Checks	critical
422182	SCA: security update for nokogiri, rexical (GHSA-cr5j-953j-xw5p)	Tenable Self-Hosted Container Security	SCA Checks	critical
407006	Alpine: ruby-nokogiri: security update to 1.10.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407006	Alpine: ruby-nokogiri: security update to 1.10.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
166069	Debian dla-3149 : ruby-nokogiri - security update	Nessus	Debian Local Security Checks	critical
166068	Debian dla-3150 : rexical - security update	Nessus	Debian Local Security Checks	critical
155347	Photon OS 2.0: Rubygem PHSA-2021-2.0-0413	Nessus	PhotonOS Local Security Checks	critical
146274	openSUSE Security Update : rubygem-nokogiri (openSUSE-2021-237)	Nessus	SuSE Local Security Checks	critical
137442	GLSA-202006-05 : Nokogiri: Command injection	Nessus	Gentoo Local Security Checks	critical
130588	Ubuntu 16.04 LTS / 18.04 LTS : Nokogiri vulnerability (USN-4175-1)	Nessus	Ubuntu Local Security Checks	critical
129363	Debian DLA-1933-1 : ruby-nokogiri security update	Nessus	Debian Local Security Checks	critical
127876	FreeBSD : Nokogiri -- injection vulnerability (0569146e-bdef-11e9-bd31-8de4a4470bbb)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-5477

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical