CVE-2019-5477 — OS Command Injection in Nokogiri

CWE-78 — OS Command Injection6 documents5 sources
Severity
9.8CRITICALNVD
EPSS
6.1%
top 9.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
NokogiriDebian RexicalDebian Ruby-nokogiri+2 more
Timeline
PublishedAug 16
Latest updateNov 5

Description

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerabil…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/ruby-nokogiri< rexical 1.0.7-1 (bookworm)
▶debiandebian/rexical< rexical 1.0.7-1 (bookworm)
▶RubyGemsnokogiri/nokogiri< 1.10.4
▶NVDnokogiri/nokogiri1.10.3

Also affects: Debian Linux 10.0, 8.0, Ubuntu Linux 16.04, 18.04, 19.04, 19.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Nokogiri Command Injection Vulnerability↗2019-08-19
▶
GHSA
Nokogiri Command Injection Vulnerability↗2019-08-19
▶
OSV
CVE-2019-5477: A command injection vulnerability in Nokogiri v1↗2019-08-16
▶

📋Vendor Advisories

2
Ubuntu
Nokogiri vulnerability↗2019-11-05
▶
Debian
CVE-2019-5477: rexical - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows command...↗2019
▶