CVE-2022-29181
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-29181
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29181.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-29181
- Aliases
- Downstream
- Related
- Published
- 2022-05-20T19:15:08Z
- Modified
- 2025-08-19T14:27:20.007993Z
- Severity
-
- 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a
Stringby calling#to_sor equivalent. - References
-
- https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267
- https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m
- https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri
- http://seclists.org/fulldisclosure/2022/Dec/23
- https://security.gentoo.org/glsa/202208-29
- https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri/
- https://support.apple.com/kb/HT213532
- https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7
- https://security-tracker.debian.org/tracker/CVE-2022-29181
Affected packages
Debian:11 / ruby-nokogiri
Package
- Name
- ruby-nokogiri
- Purl
- pkg:deb/debian/ruby-nokogiri?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.11.1+dfsg-2
1.11.1+dfsg-2+deb11u1
1.11.7+dfsg-1
1.11.7+dfsg-2
1.11.7+dfsg-3
1.13.1+dfsg-1~exp1
1.13.1+dfsg-1
1.13.1+dfsg-2~bpo11+1
1.13.1+dfsg-2
1.13.5+dfsg-1
1.13.5+dfsg-2~bpo11+1
1.13.5+dfsg-2
1.13.7+dfsg-1
1.13.7+dfsg-2
1.13.8+dfsg-1
1.13.10+dfsg-1
1.13.10+dfsg-2
1.14.2+dfsg-1
1.14.3+dfsg-1
1.14.3+dfsg-2
1.15.4+dfsg-1
1.16.0+dfsg-1
1.16.0+dfsg-2
1.16.2+dfsg-1
1.16.4+dfsg-1
1.17.2+dfsg-1~exp1
1.18.2+dfsg-1
Debian:12 / ruby-nokogiri
Package
- Name
- ruby-nokogiri
- Purl
- pkg:deb/debian/ruby-nokogiri?arch=source
Debian:13 / ruby-nokogiri
Package
- Name
- ruby-nokogiri
- Purl
- pkg:deb/debian/ruby-nokogiri?arch=source
Debian:14 / ruby-nokogiri
Package
- Name
- ruby-nokogiri
- Purl
- pkg:deb/debian/ruby-nokogiri?arch=source
Git / github.com/sparklemotion/nokogiri
Affected ranges
- Type
- GIT
- Repo
- https://github.com/sparklemotion/nokogiri
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
Affected versions
1.*
1.7.0.1-linux-binary1
REL_1.*
REL_1.0.0
REL_1.0.1
REL_1.0.2
REL_1.0.3
REL_1.0.4
REL_1.0.5
REL_1.0.6
REL_1.0.7
REL_1.1.0
REL_1.1.1
REL_1.2.0
REL_1.2.1
REL_1.2.2
REL_1.2.3
REL_1.3.0
REL_1.3.0rc1
REL_1.3.1
REL_1.3.2
REL_1.3.3
REL_1.4.0
REL_1.4.1
REL_1.4.2
REL_1.4.3
REL_1.4.3.1
REL_1.5.0.beta.1
REL_1.5.0.beta.2
v1.*
v1.10.0
v1.10.0.rc1
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.11.0.rc1
v1.11.0.rc2
v1.11.0.rc3
v1.11.0.rc4
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.0.rc1
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.4.4
v1.4.4.1
v1.4.4.2
v1.5.0
v1.5.0.beta.3
v1.5.0.beta.4
v1.5.1
v1.5.1.rc1
v1.5.2
v1.5.3
v1.5.3.rc1
v1.5.3.rc3
v1.5.3.rc4
v1.5.3.rc5
v1.5.3.rc6
v1.5.4
v1.5.4.rc1
v1.5.4.rc2
v1.5.4.rc3
v1.5.5
v1.5.5.rc1
v1.5.5.rc2
v1.5.5.rc3
v1.5.6
v1.5.6.rc1
v1.5.6.rc2
v1.5.7
v1.5.7.rc1
v1.5.7.rc2
v1.5.7.rc3
v1.5.8
v1.5.9
v1.6.0
v1.6.0.rc1
v1.6.2
v1.6.2.1
v1.6.2.beta.1
v1.6.2.rc1
v1.6.2.rc2
v1.6.2.rc3
v1.6.3
v1.6.3.1
v1.6.3.rc1
v1.6.3.rc2
v1.6.3.rc3
v1.6.4
v1.6.5
v1.6.6
v1.6.6.1
v1.6.6.2
v1.6.7.rc1
v1.6.7.rc2
v1.6.7.rc3
v1.6.7.rc4
v1.6.8
v1.6.8.rc1
v1.6.8.rc2
v1.6.8.rc3
v1.7.0
v1.7.0.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v1.9.0.rc1
v1.9.1