XML External Entity injection in Nokogiri - CVE-2020-26247

Vulnerability identifier: #VU116191

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26247

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. A remote user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Nokogiri
Gentoo Linux
openEuler
Ubuntu
rubygem-nokogiri
rubygem-nokogiri-debuginfo
rubygem-nokogiri-debugsource
rubygem-nokogiri-doc
ruby-nokogiri (Ubuntu package)
dev-ruby/nokogiri

Install updates from vendor's website.

Nokogiri - update to 1.11.0
rubygem-nokogiri - update to 1.10.5-2
rubygem-nokogiri-debuginfo - update to 1.10.5-2
rubygem-nokogiri-debugsource - update to 1.10.5-2
rubygem-nokogiri-doc - update to 1.10.5-2
ruby-nokogiri (Ubuntu package) - addressed in versions 1.10.7+dfsg1-2ubuntu0.1~esm2, 1.13.1+dfsg-2ubuntu0.1~esm1
dev-ruby/nokogiri - update to 1.13.6

• XML External Entity injection in Nokogiri
• Ubuntu update for ruby-nokogiri
• Gentoo update for Nokogiri
• openEuler 20.03 LTS SP1 update for rubygem-nokogiri