PT-2022-7289 · Nokogiri+6 · Nokogiri+6

Agustin Gianni + 1 · Published 2022-05-20 · Updated 2026-03-13 · CVE-2022-29181

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.13.6

Description The issue is related to the incorrect handling of unexpected data types in the Nokogiri library for Ruby. This can allow a remote attacker to disclose protected information or cause a denial of service. The library does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors or reads from unrelated memory.

Recommendations For versions prior to 1.13.6, upgrade to Nokogiri version 1.13.6 or later. As a temporary workaround, ensure the untrusted input is a String by calling #to s or equivalent.

Exploit

Fix

DoS

Type Confusion

Weakness Enumeration

CWE-843

CWE-241

Related Identifiers

BDU:2024-02313

CVE-2022-29181

GHSA-XH29-R2W5-WX8M

MGASA-2022-0200

OPENSUSE-SU-2022_4015-1

OPENSUSE-SU-2022_4016-1

OPENSUSE-SU-2024:12085-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

RHSA-2022:8506

SUSE-SU-2022:3890-1

SUSE-SU-2022:4015-1

SUSE-SU-2022:4016-1

USN-7659-1

Affected Products

Debian

Linuxmint

Apple Macos

Nokogiri

Red Os

Suse

Ubuntu

References · 97

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29181.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-29181.yml · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri · Exploit
• https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:14174-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/4J4GGCK2IK6R7HJKHPGPCCZRBXEWHBVC · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40303 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29181 · Security Note
• https://osv.dev/vulnerability/GHSA-xh29-r2w5-wx8m · Vendor Advisory
• https://osv.dev/vulnerability/USN-7659-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29181 · Security Note
• https://security.gentoo.org/glsa/202208-29 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3890-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-29181 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory