OESA-2021-1396

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1396

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2021-1396.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2021-1396

Upstream

CVE-2021-41098

Published

2021-10-19T11:03:17Z

Modified

2025-08-12T05:10:06.066277Z

Summary

rubygem-nokogiri security update

Details

Nokogiri parses and searches XML/HTML very quickly, and also has correctly implemented CSS3 selector support as well as XPath support. Nokogiri also features an Hpricot compatibility layer to help ease the change to using correct CSS and XPath. %if 0

Security Fix(es):

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.(CVE-2021-41098)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP1 / rubygem-nokogiri

Package

Name: rubygem-nokogiri
Purl: pkg:rpm/openEuler/rubygem-nokogiri&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.10.5-3.oe1

Ecosystem specific

{
    "aarch64": [
        "rubygem-nokogiri-debuginfo-1.10.5-3.oe1.aarch64.rpm",
        "rubygem-nokogiri-1.10.5-3.oe1.aarch64.rpm",
        "rubygem-nokogiri-doc-1.10.5-3.oe1.aarch64.rpm",
        "rubygem-nokogiri-debugsource-1.10.5-3.oe1.aarch64.rpm"
    ],
    "src": [
        "rubygem-nokogiri-1.10.5-3.oe1.src.rpm"
    ],
    "x86_64": [
        "rubygem-nokogiri-doc-1.10.5-3.oe1.x86_64.rpm",
        "rubygem-nokogiri-debugsource-1.10.5-3.oe1.x86_64.rpm",
        "rubygem-nokogiri-debuginfo-1.10.5-3.oe1.x86_64.rpm",
        "rubygem-nokogiri-1.10.5-3.oe1.x86_64.rpm"
    ]
}

openEuler:20.03-LTS-SP2 / rubygem-nokogiri

Package

Name: rubygem-nokogiri
Purl: pkg:rpm/openEuler/rubygem-nokogiri&distro=openEuler-20.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.10.5-3.oe1

Ecosystem specific

{
    "aarch64": [
        "rubygem-nokogiri-1.10.5-3.oe1.aarch64.rpm",
        "rubygem-nokogiri-debuginfo-1.10.5-3.oe1.aarch64.rpm",
        "rubygem-nokogiri-doc-1.10.5-3.oe1.aarch64.rpm",
        "rubygem-nokogiri-debugsource-1.10.5-3.oe1.aarch64.rpm"
    ],
    "src": [
        "rubygem-nokogiri-1.10.5-3.oe1.src.rpm"
    ],
    "x86_64": [
        "rubygem-nokogiri-1.10.5-3.oe1.x86_64.rpm",
        "rubygem-nokogiri-doc-1.10.5-3.oe1.x86_64.rpm",
        "rubygem-nokogiri-debuginfo-1.10.5-3.oe1.x86_64.rpm",
        "rubygem-nokogiri-debugsource-1.10.5-3.oe1.x86_64.rpm"
    ]
}