🚨 [security] Update nokogiri: 1.10.4 → 1.10.10 (patch) #27

depfu · 2023-03-09T10:09:17Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ nokogiri (indirect, 1.10.4 → 1.10.10) · Repo · Changelog

Security Advisories 🚨

🚨 libxslt Type Confusion vulnerability that affects Nokogiri

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.

🚨 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

🚨 Nokogiri gem, via libxslt, is affected by multiple vulnerabilities

Nokogiri v1.10.5 has been released.

This is a security release. It addresses three CVEs in upstream libxml2,
for which details are below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
these vulnerabilities.

Full details about the security update are available in Github Issue
[#1943] #1943.

CVE-2019-13117

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
could allow an attacker to discern whether a byte on the stack contains the
characters A, a, I, i, or 0, or any other character.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1

CVE-2019-13118

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
xsl:number instruction was too narrow and an invalid character/length
combination could be passed to xsltNumberFormatDecimal, leading to a read
of uninitialized stack data

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b

CVE-2019-18197

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html

Priority: Medium

Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
reset under certain circumstances. If the relevant memory area happened to
be freed and reused in a certain way, a bounds check could fail and memory
outside a buffer could be written to, or uninitialized data could be
disclosed.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285

Release Notes

1.10.10

1.10.10 / 2020-07-06

Features

[MRI] Cross-built Windows gems now support Ruby 2.7 [#2029]. Note that prior to this release, the v1.11.x prereleases provided this support.

1.10.9

1.10.9 / 2020-03-01

Fixed

[MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]

[JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, @headius!)

1.10.8

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7

1.10.7 / 2019-12-03

Bug

[MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6

1.10.6 / 2019-12-03

Bug

[MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5

1.10.5 / 2019-10-31

Dependencies

[MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10

[MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 31 commits:

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

google-cla · 2023-03-09T10:09:26Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

changeset-bot · 2023-03-09T10:09:26Z

⚠️ No Changeset found

Latest commit: e4ba55c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

sonarqubecloud · 2023-03-09T10:09:47Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

vtex-io-ci-cd · 2023-03-09T10:10:22Z

Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖

Please select which version do you want to release:

Patch (backwards-compatible bug fixes)
Minor (backwards-compatible functionality)
Major (incompatible API changes)

And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.

No thanks, I would rather do it manually 😞

depfu · 2023-03-09T10:17:32Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:33Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:37Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:38Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:39Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:43Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:44Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:47Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:48Z

Closed in favor of #28.

depfu · 2023-03-09T10:17:56Z

Closed in favor of #28.

depfu · 2023-03-09T10:18:03Z

Closed in favor of #28.

depfu · 2023-03-09T10:18:16Z

Closed in favor of #28.

depfu · 2023-03-09T10:18:36Z

Closed in favor of #28.

Update nokogiri to version 1.10.10

e4ba55c

depfu bot added the depfu label Mar 9, 2023

pull-request-size bot added the size/XS label Mar 9, 2023

pr-triage bot added the PR: unreviewed label Mar 9, 2023

depfu bot closed this Mar 9, 2023

depfu bot deleted the depfu/update/nokogiri-1.10.10 branch March 9, 2023 10:17

🚨 [security] Update nokogiri: 1.10.4 → 1.10.10 (patch) #27

🚨 [security] Update nokogiri: 1.10.4 → 1.10.10 (patch) #27

Uh oh!

Conversation

depfu bot commented Mar 9, 2023

What changed?

↗️ nokogiri (indirect, 1.10.4 → 1.10.10) · Repo · Changelog

1.10.10 / 2020-07-06

Features

1.10.9 / 2020-03-01

Fixed

1.10.8 / 2020-02-10

Security

1.10.7 / 2019-12-03

Bug

1.10.6 / 2019-12-03

Bug

1.10.5 / 2019-10-31

Dependencies

Uh oh!

google-cla bot commented Mar 9, 2023

Uh oh!

changeset-bot bot commented Mar 9, 2023

⚠️ No Changeset found

Uh oh!

sonarqubecloud bot commented Mar 9, 2023

Uh oh!

vtex-io-ci-cd bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

depfu bot commented Mar 9, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant