Sha256: ee489183b9be7b7f9888f8d3665296819ed06c559fadd00e8d897a712f41d588
Contents?: true
Size: 1.4 KB
Versions: 5
Compression:
Stored size: 1.4 KB
Contents
---
gem: nokogiri
cve: 2017-5029
url: https://github.com/sparklemotion/nokogiri/issues/1634
title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29
date: 2017-05-09
description: |
nokogiri version 1.7.2 has been released.
This is a security update based on 1.7.1, addressing two upstream
libxslt 1.1.29 vulnerabilities classified as "Medium" by Canonical
and given a CVSS3 score of "6.5 Medium" and "8.8 High" by RedHat.
These patches only apply when using Nokogiri's vendored libxslt
package. If you're using your distro's system libraries, there's no
need to upgrade from 1.7.0.1 or 1.7.1 at this time.
Full details are available at the github issue linked to in the
changelog below.
-----
# 1.7.2 / 2017-05-09
## Security Notes
[MRI] Upstream libxslt patches are applied to the vendored libxslt
1.1.29 which address CVE-2017-5029 and CVE-2016-4738.
For more information:
* https://github.com/sparklemotion/nokogiri/issues/1634
* http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
* http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
patched_versions:
- ">= 1.7.2"
related:
cve:
- 2016-4738
- 2017-5029
url:
- http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
- http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
Version data entries
5 entries across 5 versions & 2 rubygems