Bugzilla – Bug 911804
VUL-0: CVE-2012-6685: rubygem-nokogiri: XML eXternal Entity (XXE) flaw
Last modified: 2015-01-16 09:43:20 UTC
CVE-2012-6685 An XML eXternal Entity (XXE) flaw was found in Nokogiri, a Ruby gem for parsing HTML, XML, and SAX. Using external XML entities, a remote attacker could specify a URL in a specially crafted XML that, when parsed, would cause a connection to that URL to be opened. A patch shipped with the 1.5.4 release of Nokogiri provided a "nonet" option to disable external connections. However, local file URLs could still be used to exploit this flaw. The 1.6.4 release of Nokogiri fixed this issue by using libxml2 2.9.0. References: https://github.com/sparklemotion/nokogiri/issues/693#issuecomment-68334768 https://bugzilla.redhat.com/show_bug.cgi?id=1178970 http://seclists.org/oss-sec/2015/q1/57
bugbot adjusting priority
this smells like "we only fixed the intree copy of libxml2" as such we would need to check our libxml2 packages if they are affected as our normal nokogiri build should not be using the intree libxml2.
SLE-12 you are right, but I think the old versions, are using the bundled one. Please check the codestream SLE-11-SP2:GA.
sle11 version does not have an intree copy.
checked all others too. all the 1.6.x nokogiri versions build with the system libraries export. and 1.4 is not affected.
ok thank you.