Skip to content
OpenAdvisories

Description

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Affected products

VendorProductAffectedFixed
sparklemotion nokogiri 1.5.1 – < 1.19.1 1.19.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ruby-nokogiri 1.19.1+dfsg-1 —
Debian 13 ruby-nokogiri No fix yet —
Debian 12 ruby-nokogiri No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS ruby-nokogiri No fix yet —
Ubuntu 24.04 LTS ruby-nokogiri No fix yet —
Ubuntu 18.04 LTS ruby-nokogiri No fix yet —
Ubuntu 16.04 LTS ruby-nokogiri No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 20.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 14.04 LTS ruby-nokogiri No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling logstash-9.3 +2 No fix yet —
Wolfi rolling ruby3.2-rails-8.1 +2 8.1.2-r1 —
Wolfi rolling ruby3.3-rails-8.1 8.1.2-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems nokogiri >= 1.5.1, < 1.19.1 1.19.1 GHSA-wx95-c6cv-8532

References