Vulnerability GHSA-phwj-rprq-35pp

Low Risk

4 months ago

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

1.0.0 - 1.4.2 and 1.4.2.1 and 1.4.3 and 1.4.3.1 and 1.4.4 and 1.4.4.1 and 1.4.4.2 and 1.4.5 - 1.4.7 and 1.5.0.beta.1 and 1.5.0.beta.2 and 1.5.0.beta.3 and 1.5.0.beta.4 and 1.5.0 and 1.5.1.rc1 and 1.5.1 - 1.5.2 and 1.5.3.rc2 and 1.5.3.rc3 and 1.5.3.rc4 and 1.5.3.rc5 and 1.5.3.rc6 and 1.5.3 and 1.5.4.rc1 and 1.5.4.rc2 and 1.5.4.rc3 and 1.5.4 and 1.5.5.rc1 and 1.5.5.rc2 and 1.5.5.rc3 and 1.5.5 and 1.5.6.rc1 and 1.5.6.rc2 and 1.5.6.rc3 and 1.5.6 and 1.5.7.rc1 and 1.5.7.rc2 and 1.5.7.rc3 and 1.5.7 - 1.5.11 and 1.6.0.rc1 and 1.6.0 - 1.6.1 and 1.6.2.rc1 and 1.6.2.rc2 and 1.6.2.rc3 and 1.6.2 and 1.6.2.1 and 1.6.3.rc1 and 1.6.3.rc2 and 1.6.3.rc3 and 1.6.3 and 1.6.3.1 and 1.6.4 and 1.6.4.1 and 1.6.5 and 1.6.6.1 and 1.6.6.2 and 1.6.6.3 and 1.6.6.4 and 1.6.7.rc2 and 1.6.7.rc3 and 1.6.7.rc4 and 1.6.7 and 1.6.7.1 and 1.6.7.2 and 1.6.8.rc1 and 1.6.8.rc2 and 1.6.8.rc3 and 1.6.8 and 1.6.8.1 and 1.7.0 and 1.7.0.1 and 1.7.1 - 1.8.5 and 1.9.0.rc1 and 1.9.0 - 1.9.1 and 1.10.0.rc1 and 1.10.0 - 1.10.10 and 1.11.0.rc1 and 1.11.0.rc2 and 1.11.0.rc3 and 1.11.0.rc4 and 1.11.0 - 1.11.7 and 1.12.0.rc1 and 1.12.0 - 1.13.10 and 1.14.0.rc1 and 1.14.0 - 1.15.7 and 1.16.0.rc1 and 1.16.0 - 1.17.2 and 1.18.0.rc1 and 1.18.0 - 1.19.3

Summary

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Details

Summary

Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault.

Nokogiri 1.19.4 preserves any already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child node and then replace that same attribute's value via Attr#value= or #content=. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. Already-wrapped attribute child nodes are preserved before the value is replaced.