CVE-2022-24836
moderate-risk
Published 2022-04-11
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Do I need to act?
~
1.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (7)
Affected Vendors
References (21)
Mailing List
http://seclists.org/fulldisclosure/2022/Dec/23
Third Party Advisory
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw...
Third Party Advisory
https://security.gentoo.org/glsa/202208-29
Third Party Advisory
https://support.apple.com/kb/HT213532
Mailing List
http://seclists.org/fulldisclosure/2022/Dec/23
Third Party Advisory
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw...
Third Party Advisory
https://security.gentoo.org/glsa/202208-29
and 1 more references
44
/ 100
moderate-risk
Severity
26/34 · High
Exploitability
4/34 · Minimal
Exposure
14/34 · Moderate