X Tutup
The Wayback Machine - https://web.archive.org/web/20201129200146/https://github.com/github/pages-gem/issues/681
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade nokogiri to version 1.10.8 or later #681

Open
mrpandey opened this issue Feb 28, 2020 · 0 comments
Open

Upgrade nokogiri to version 1.10.8 or later #681

mrpandey opened this issue Feb 28, 2020 · 0 comments

Comments

@mrpandey
Copy link

@mrpandey mrpandey commented Feb 28, 2020

I received an alert on GitHub saying that current nokogiri version is vulnerable. Suggested remediation is to update nokogiri to version 1.10.8. Currently it is 1.10.4.

CVE-2020-7595
moderate severity
Vulnerable versions: < 1.10.8
Patched version: 1.10.8

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file > situation.
The Nokogiri RubyGem has patched it's vendored copy of libxml2 in order to prevent this issue from affecting nokogiri.

mrpandey added a commit to mrpandey/pages-gem that referenced this issue Feb 28, 2020
The current version of nokogiri 1.10.4 has vulnerability issues. This commit should fix issue github#681.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.
X Tutup