Ubuntu 19.10: USN-4175-1 Critical: Nokogiri Remote Code Execution

ubuntu

November 5, 2019

Nokogiri could be made to execute programs if it received specially crafted input.

Summary

Nokogiri could be made to execute programs if it received

specially crafted input.

Software Description:

- ruby-nokogiri: HTML, XML, SAX, and Reader parser for Ruby

Details:

It was discovered that Nokogiri incorrectly handled inputs. A remote attacker

could possibly use this issue to execute arbitrary OS commands.

Topics Covered

security advisory security issue update remote code execution ubuntu arbitrary execution nokogiri

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  ruby-nokogiri                   1.10.3+dfsg1-2ubuntu0.1

Ubuntu 19.04:
  ruby-nokogiri                   1.10.0+dfsg1-2ubuntu0.1

Ubuntu 18.04 LTS:
  ruby-nokogiri                   1.8.2-1ubuntu0.1

Ubuntu 16.04 LTS:
  ruby-nokogiri                   1.6.7.2-3ubuntu0.1

In general, a standard system update will make all the necessary changes.