CVE-2022-24836

Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 11 Apr 2022, 00:00
Last modified:03 Sept 2024, 12:03

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.83% LOW
2% probability +0.37%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Apr 2022, 00:00
Published
Vulnerability first disclosed
03 Sept 2024, 12:03
Last Modified
Vulnerability information updated

Description

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 1.83%• Percentile: 83%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-1333•Inefficient Regular Expression Complexity

    The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected Systems

  • Unknown•macOS

    ≥ 13.0, < 13.1

  • debian•debian_linux

    9.0 | 10.0

  • fedoraproject•fedora

    34 | 35 | 36

  • nokogiri•nokogiri

    < 1.13.4

  • sparklemotion•nokogiri

    < 1.13.4

References (11)