← Back to CVEs
CVE-2019-5477
CRITICAL9.8
Description
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published8/16/2019
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
canonical:ubuntu_linuxdebian:debian_linuxnokogiri:nokogiri
Weaknesses (CWE)
CWE-78CWE-78
References
https://github.com/sparklemotion/nokogiri/issues/1915(support@hackerone.com)
https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc(support@hackerone.com)
https://hackerone.com/reports/650835(support@hackerone.com)
https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html(support@hackerone.com)
https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html(support@hackerone.com)
https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html(support@hackerone.com)
https://security.gentoo.org/glsa/202006-05(support@hackerone.com)
https://usn.ubuntu.com/4175-1/(support@hackerone.com)
https://github.com/sparklemotion/nokogiri/issues/1915(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc(af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/650835(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html(af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202006-05(af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/4175-1/(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.