CVE-2022-24836
Inefficient Regular Expression Complexity in Nokogiri
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Nokogiri es una biblioteca XML y HTML de código abierto para Ruby. Nokogiri versiones anteriores a v1.13.4 contiene una expresión regular ineficiente que es susceptible de un retroceso excesivo cuando intenta detectar la codificación en documentos HTML. Se recomienda a usuarios actualizar a Nokogiri versiones posteriores a 1.13.4 incluyéndola. No se presentan medidas de mitigación conocidas para este problema
A flaw was found in the nokogiri library when processing an inefficient and complex regular expression. This flaw allows an attacker to cause excessive consumption of resources, which affects performance.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-02-10 CVE Reserved
- 2022-04-11 CVE Published
- 2023-12-01 EPSS Updated
- 2024-09-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-1333: Inefficient Regular Expression Complexity
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2022/Dec/23 | Mailing List |
|
| https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html | Mailing List |
|
| https://support.apple.com/kb/HT213532 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nokogiri Search vendor "Nokogiri" | Nokogiri Search vendor "Nokogiri" for product "Nokogiri" | < 1.13.4 Search vendor "Nokogiri" for product "Nokogiri" and version " < 1.13.4" | ruby |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Macos Search vendor "Apple" for product "Macos" | >= 13.0 < 13.1 Search vendor "Apple" for product "Macos" and version " >= 13.0 < 13.1" | - |
Affected
| ||||||