SB2025093034 - Ubuntu update for ruby-nokogiri

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) XML External Entity injection (CVE-ID: CVE-2020-26247)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. A remote user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

2) Input validation error (CVE-ID: CVE-2022-29181)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed into the XML and HTML4 SAX parsers. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

3) Integer overflow (CVE-ID: CVE-2022-40303)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in parse.c when processing content when XML_PARSE_HUGE is set. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-7659-1