CVE - CVE-2020-26247

CVE-ID
CVE-2020-26247	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m URL:https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m GENTOO:GLSA-202208-29 URL:https://security.gentoo.org/glsa/202208-29 MISC:https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b URL:https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b MISC:https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4 URL:https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4 MISC:https://hackerone.com/reports/747489 URL:https://hackerone.com/reports/747489 MISC:https://rubygems.org/gems/nokogiri URL:https://rubygems.org/gems/nokogiri MLIST:[debian-lts-announce] 20210606 [SECURITY] [DLA 2678-1] ruby-nokogiri security update URL:https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html MLIST:[debian-lts-announce] 20221012 [SECURITY] [DLA 3149-1] ruby-nokogiri security update URL:https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20201001	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20201001)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)