Skip to content
OpenAdvisories
Low · 2.6 CVE-2020-26247 EUVD-2020-1507GHSA-vr8q-g5c7-m54m

XXE in Nokogiri

Published Dec 30, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: sparklemotion Product: nokogiri Package: nokogiri Package: ruby-nokogiri Package: ruby-nokogiri Package: ruby-nokogiri Ecosystem: Alpine Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

Affected products

VendorProductAffectedFixed
sparklemotion nokogiri < 1.11.0.rc4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-nokogiri 1.11.1+dfsg-1 —
Debian 13 ruby-nokogiri 1.11.1+dfsg-1 —
Debian 12 ruby-nokogiri 1.11.1+dfsg-1 —
Debian 10 ruby-nokogiri 1.10.0+dfsg1-2+deb10u1 DLA-3149-1
Debian 9 ruby-nokogiri 1.6.8.1-1+deb9u1 DLA-2678-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-nokogiri 1.13.1+dfsg-2ubuntu0.1~esm1 USN-7659-1
Ubuntu Pro 20.04 LTS ruby-nokogiri 1.10.7+dfsg1-2ubuntu0.1~esm2 USN-7659-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 foreman 2.5.2.17-2.el7sat RHSA-2021:4702
Red Hat Satellite Capsule 6 python-aiohttp 3.7.4-1.el7pc RHSA-2021:4702
Red Hat Satellite Capsule 6 python-ecdsa +1 0.13.3-2.el7pc RHSA-2021:4702
Red Hat Satellite Capsule 6 python-pyyaml +1 5.4.1-1.el7pc RHSA-2021:4702
Red Hat Satellite Capsule 6 python-urllib3 +1 1.26.5-1.el7pc RHSA-2021:4702
Red Hat Satellite Capsule 6 python3-django 2.2.24-1.el7pc RHSA-2021:4702
Red Hat Satellite Capsule 6 satellite +1 6.10.0-3.el7sat RHSA-2021:4702
Red Hat Satellite Capsule 6 tfm-rubygem-nokogiri 1.11.3-2.el7sat RHSA-2021:4702
Red Hat Satellite 6 candlepin 4.0.9-1.el7sat RHSA-2021:4702
Red Hat Satellite 6 foreman 2.5.2.17-2.el7sat RHSA-2021:4702
Red Hat Satellite 6 python-aiohttp 3.7.4-1.el7pc RHSA-2021:4702
Red Hat Satellite 6 python-ecdsa +1 0.13.3-2.el7pc RHSA-2021:4702
Red Hat Satellite 6 python-pyyaml +1 5.4.1-1.el7pc RHSA-2021:4702
Red Hat Satellite 6 python-urllib3 +1 1.26.5-1.el7pc RHSA-2021:4702
Red Hat Satellite 6 python3-django 2.2.24-1.el7pc RHSA-2021:4702
Red Hat Satellite 6 satellite 6.10.0-3.el7sat RHSA-2021:4702
Red Hat Satellite 6 tfm-rubygem-activerecord-session_store 2.0.0-1.el7sat RHSA-2021:4702
Red Hat Satellite 6 tfm-rubygem-addressable 2.8.0-1.el7sat RHSA-2021:4702
Red Hat Satellite 6 tfm-rubygem-nokogiri 1.11.3-2.el7sat RHSA-2021:4702
Red Hat Satellite 6 tfm-rubygem-puma 5.3.2-1.el7sat RHSA-2021:4702
Red Hat Satellite 6 tfm-rubygem-rails +1 6.0.3.7-1.el7sat RHSA-2021:4702

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP2 rubygem-nokogiri 1.8.5-3.6.1 SUSE-SU-2021:0251-1
SLES 15 SP1 rubygem-nokogiri 1.8.5-3.6.1 SUSE-SU-2021:0251-1
SLES 15 rubygem-nokogiri 1.8.5-3.6.1 SUSE-SU-2021:0251-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 rubygem-nokogiri 1.6.1-5.3.1 SUSE-SU-2021:0210-1
SUSE OpenStack Cloud Crowbar 8 cassandra 3.11.10-5.3.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 crowbar-core 5.0+git.1622489449.a8e60e238-3.50.4 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 crowbar-openstack 5.0+git.1616001417.67fd9c2a1-4.52.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 documentation-suse-openstack-cloud-deployment +3 8.20210512-1.32.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 grafana 6.7.4-4.18.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 kibana 4.6.6-3.9.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 openstack-heat-templates 0.0.0+git.1623056900.7917e18-3.21.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 openstack-monasca-installer 20190923_16.32-3.18.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 openstack-nova +1 16.1.9~dev92-3.48.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 python-Django 1.11.29-3.25.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 python-elementpath 1.3.1-1.3.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 python-eventlet 0.20.0-6.3.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 python-py 1.4.34-3.3.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 python-pysaml2 4.0.2-5.9.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 python-xmlschema 1.0.18-1.3.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 rubygem-activerecord-session_store 0.1.2-3.3.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud Crowbar 8 rubygem-nokogiri 1.6.1-5.3.1 SUSE-SU-2021:0210-1
SUSE OpenStack Cloud 8 ardana-cobbler 8.0+git.1614096566.e8c2b27-3.44.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 cassandra 3.11.10-5.3.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-user +8 8.20210512-1.32.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 grafana 6.7.4-4.18.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 kibana 4.6.6-3.9.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 openstack-heat-templates 0.0.0+git.1623056900.7917e18-3.21.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 openstack-monasca-installer 20190923_16.32-3.18.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 openstack-nova +1 16.1.9~dev92-3.48.5 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 python-Django 1.11.29-3.25.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 python-elementpath 1.3.1-1.3.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 python-eventlet 0.20.0-6.3.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 python-py 1.4.34-3.3.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 python-pysaml2 4.0.2-5.9.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 python-xmlschema 1.0.18-1.3.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-aodh 5.1.1~dev7-12.32.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-barbican 5.0.2~dev3-12.33.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-ceilometer 9.0.8~dev7-12.30.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-cinder 11.2.3~dev29-14.34.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-designate 5.0.3~dev7-12.31.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-freezer 5.0.0.0~xrc2~dev2-10.28.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-glance 15.0.3~dev3-12.31.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-heat 9.0.8~dev22-12.33.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-horizon 12.0.5~dev6-14.36.6 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-ironic 9.1.8~dev8-12.33.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-keystone 12.0.4~dev11-11.35.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-magnum 5.0.2_5.0.2_5.0.2~dev31-11.32.2 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-manila 5.1.1~dev5-12.37.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-monasca 2.2.2~dev1-11.28.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-monasca-ceilometer 1.5.1_1.5.1_1.5.1~dev3-8.28.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-murano 4.0.2~dev2-12.28.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-neutron 11.0.9~dev69-13.38.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-nova 16.1.9~dev92-11.36.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-octavia 1.0.6~dev3-12.33.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-sahara 7.0.5~dev4-11.32.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-swift 2.15.2_2.15.2_2.15.2~dev32-11.23.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 8 venv-openstack-trove 8.0.2~dev2-11.32.3 SUSE-SU-2021:2554-1
SUSE OpenStack Cloud 7 rubygem-nokogiri 1.6.1-5.3.1 SUSE-SU-2021:0210-1
SUSE HPE Helion OpenStack 8 ardana-cobbler 8.0+git.1614096566.e8c2b27-3.44.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 cassandra 3.11.10-5.3.5 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 documentation-hpe-helion-openstack-user +5 8.20210512-1.32.5 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 grafana 6.7.4-4.18.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 kibana 4.6.6-3.9.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 openstack-heat-templates 0.0.0+git.1623056900.7917e18-3.21.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 openstack-monasca-installer 20190923_16.32-3.18.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 openstack-nova +1 16.1.9~dev92-3.48.5 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 python-Django 1.11.29-3.25.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 python-elementpath 1.3.1-1.3.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 python-eventlet 0.20.0-6.3.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 python-py 1.4.34-3.3.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 python-pysaml2 4.0.2-5.9.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 python-xmlschema 1.0.18-1.3.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-aodh 5.1.1~dev7-12.32.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-barbican 5.0.2~dev3-12.33.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-ceilometer 9.0.8~dev7-12.30.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-cinder 11.2.3~dev29-14.34.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-designate 5.0.3~dev7-12.31.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-freezer 5.0.0.0~xrc2~dev2-10.28.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-glance 15.0.3~dev3-12.31.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-heat 9.0.8~dev22-12.33.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-horizon-hpe 12.0.5~dev6-14.36.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-ironic 9.1.8~dev8-12.33.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-keystone 12.0.4~dev11-11.35.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-magnum 5.0.2_5.0.2_5.0.2~dev31-11.32.2 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-manila 5.1.1~dev5-12.37.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-monasca 2.2.2~dev1-11.28.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-monasca-ceilometer 1.5.1_1.5.1_1.5.1~dev3-8.28.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-murano 4.0.2~dev2-12.28.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-neutron 11.0.9~dev69-13.38.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-nova 16.1.9~dev92-11.36.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-octavia 1.0.6~dev3-12.33.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-sahara 7.0.5~dev4-11.32.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-swift 2.15.2_2.15.2_2.15.2~dev32-11.23.3 SUSE-SU-2021:2554-1
SUSE HPE Helion OpenStack 8 venv-openstack-trove 8.0.2~dev2-11.32.3 SUSE-SU-2021:2554-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.2 rubygem-nokogiri 1.8.5-lp152.4.3.1 openSUSE-SU-2021:0237-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 ruby-nokogiri 1.11.6-r0 —
Alpine v3.23 ruby-nokogiri 1.11.6-r0 —
Alpine v3.22 ruby-nokogiri 1.11.6-r0 —
Alpine v3.21 ruby-nokogiri 1.11.6-r0 —
Alpine v3.20 ruby-nokogiri 1.11.6-r0 —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 ruby-nokogiri 1.11.6-r0 —
Alpine v3.18 ruby-nokogiri 1.11.6-r0 —
Alpine v3.17 ruby-nokogiri 1.11.6-r0 —
Alpine v3.16 ruby-nokogiri 1.11.6-r0 —
Alpine v3.15 ruby-nokogiri 1.11.6-r0 —
Alpine v3.14 ruby-nokogiri 1.11.6-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems nokogiri < 1.11.0 1.11.0 GHSA-vr8q-g5c7-m54m

Advisories 8

References