Alerts This Week
Warning Icon 1 1,149
Alerts This Week
Warning Icon 1 1,149

Ubuntu 22.04 LTS: Nokogiri Important Code Exec & DoS Issues USN-7659-1

ubuntu
Calendar Grey July 22, 2025
Dist Ubuntu Esm H88
Numerous vulnerabilities within Nokogiri may result in unauthorized code execution and service disruption. It's advisable to update for enhanced security.
Several security issues were fixed in Nokogiri.

Summary

Several security issues were fixed in Nokogiri.

Software Description:

- ruby-nokogiri: HTML, XML, SAX, and Reader parser for Ruby

Details:

It was discovered Nokogiri did not correctly parse XML Schemas.

If a user or automated system were tricked into opening a specially

crafted file, an attacker could possibly use this issue to execute

arbitrary code. This issue only affected Ubuntu 20.04 LTS.

(CVE-2020-26247)

Agustin Gianni discovered that Nokogiri did not correctly parse

XML and HTML files. If a user or automated system were tricked into

opening a specially crafted file, an attacker could possibly use this

issue to cause a denial of service or leak sensitive information.

(CVE-2022-29181)

Topics%20covered

Topics Covered

security advisory denial of service code execution Ubuntu important rubynokogiri

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  ruby-nokogiri                   1.13.1+dfsg-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  ruby-nokogiri                   1.10.7+dfsg1-2ubuntu0.1~esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-7659-1

CVE-2020-26247, CVE-2022-29181, CVE-2022-40303

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7659-1

Topics%20covered

Topics Covered

security advisory denial of service code execution Ubuntu important rubynokogiri

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here