Ubuntu alert USN-7659-1 (ruby-nokogiri)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7659-1] Nokogiri vulnerabilities
Date:
             
 
Tue, 22 Jul 2025 03:14:53 +0000
Message-ID:
             
 
<E1ue3Sv-0006WG-8K@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7659-1
July 21, 2025

ruby-nokogiri vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Nokogiri.

Software Description:
- ruby-nokogiri: HTML, XML, SAX, and Reader parser for Ruby

Details:

It was discovered Nokogiri did not correctly parse XML Schemas.
If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-26247)

Agustin Gianni discovered that Nokogiri did not correctly parse
XML and HTML files. If a user or automated system were tricked into
opening a specially crafted file, an attacker could possibly use this
issue to cause a denial of service or leak sensitive information.
(CVE-2022-29181)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  ruby-nokogiri                   1.13.1+dfsg-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  ruby-nokogiri                   1.10.7+dfsg1-2ubuntu0.1~esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7659-1
  CVE-2020-26247, CVE-2022-29181, CVE-2022-40303


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmh+/0EACgkQcpJm3tlz
hgEbqxAAhR/pflexiELyuDD7anG8E42J+3/Vof7ETf0E1opOxFHHV/Tjd8aPm1Ne
hT/jI8IJ2/ybtf5aBQjPQeyyLwc3hZxGyF8mBptdsBZ9eBUMObA9dOlM7BCgq7A7
wH5MUxVH3hu1X8k9M6u9H1eum4pqp54w23J0EUkCN4W8JyRp4MVltdxcfZIFCUut
iahL41+80UM7FEHlbv54yr/rWoiMPPSygkKWSw39sEYuq0vmoKEQBmFNzspmCoeh
CysFCwyjsdjdEfXan37pL1TTOaCzQkd6zYgZc+yaNZ/EcrJ73U3zU93RrIAoN6hS
CqNUeY82ePVV2aH3htpO/8kdkiR66EWrF65VniE/UOpqoNXBRNOJnkG4BJiIlFJG
Dd0ZibEkSGMd2Y4nllhPbRxADhfFWLSYOUXice1KJTP6mt0Maq2kXrevDi43q/R/
lYBH5ZpN3hY8I8i3/nxx2OfztHCe3rHjyU3dhmzs+zVhXi2cfu8gE6Q8gp1S+Zgo
zDA7UHHbgFbIQRvQlt6B6HoAQ9qb5V12Ew/KV+8jnGlFE0rPGIIXVNBkCtzI060P
v3J2a89H0FRLO1aLg25XEPuzzseqOhDc6uai/cjV7Q+I3BHpjrBlzAz4IdVUC5tB
/lyb0izv+WCZ3GtkLm5FFgFXGy7Zdj3eWBtY+ZqSg3DiEM3zCAw=
=6bIx
-----END PGP SIGNATURE-----