Skip to content

Commit 072c7fe

Browse files
rakviumrakvium
committed
GHSA SYNC: 20 new advisories
- gems/Autolab/CVE-2024-49376.yml - gems/alchemy_cms/CVE-2018-18307.yml - gems/arabic-prawn/CVE-2014-2322.yml - gems/camaleon_cms/GHSA-3hp8-6j24-m5gm.yml - gems/fluentd-ui/CVE-2020-21514.yml - gems/fluentd/CVE-2020-21514.yml - gems/nokogiri/GHSA-fq42-c5rg-92c2.yml - gems/nokogiri/GHSA-gx8x-g87m-h5q6.yml - gems/nokogiri/GHSA-v6gp-9mmm-c6p5.yml - gems/nokogiri/GHSA-vcc3-rw6f-jv97.yml - gems/nokogiri/GHSA-xxx9-3xcr-gjj3.yml - gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml - gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml - gems/rails/CVE-2024-26143.yml - gems/redcloth/CVE-2012-6684.yml - gems/spree_auth_devise/GHSA-6mqr-q86q-6gwr.yml - gems/spree_auth_devise/GHSA-8xfw-5q82-3652.yml - gems/spree_auth_devise/GHSA-gpqc-4pp7-5954.yml - gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml - gems/webrick/CVE-2009-4492.yml
1 parent 1f5c25f commit 072c7fe

20 files changed

+714
-0
lines changed

‎gems/Autolab/CVE-2024-49376.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
gem: Autolab
3+
cve: 2024-49376
4+
ghsa: v46j-h43h-rwrm
5+
url: https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
6+
title: Autolab Misconfigured Reset Password Permissions
7+
date: 2024-10-25
8+
description: |
9+
### Impact
10+
For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords.
11+
12+
### Patches
13+
This is fixed in v3.0.1.
14+
15+
### Workarounds
16+
No workarounds.
17+
18+
### For more information
19+
If you have any questions or comments about this advisory:
20+
21+
Open an issue in https://github.com/autolab/Autolab/
22+
Email us at [[email protected]](mailto:[email protected])
23+
cvss_v3: 8.8
24+
cvss_v4: 7.1
25+
unaffected_versions:
26+
- "< 3.0.0"
27+
patched_versions:
28+
- ">= 3.0.1"
29+
related:
30+
url:
31+
- url: https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
32+
- url: https://nvd.nist.gov/vuln/detail/CVE-2024-49376
33+
- url: https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b
34+
- url: https://github.com/advisories/GHSA-v46j-h43h-rwrm

‎gems/alchemy_cms/CVE-2018-18307.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
gem: alchemy_cms
3+
cve: 2018-18307
4+
ghsa: 7mj4-2984-955f
5+
url: http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
6+
title: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
7+
date: 2022-05-14
8+
description: A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS
9+
via the /admin/pictures image filename field.
10+
cvss_v3: 5.9
11+
unaffected_versions:
12+
- "< 4.1.0"
13+
notes: Never patched
14+
related:
15+
url:
16+
- url: https://nvd.nist.gov/vuln/detail/CVE-2018-18307
17+
- url: http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
18+
- url: https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15
19+
- url: https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5
20+
- url: https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21
21+
- url: https://github.com/advisories/GHSA-7mj4-2984-955f

‎gems/arabic-prawn/CVE-2014-2322.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
gem: arabic-prawn
3+
cve: 2014-2322
4+
ghsa: hgmw-x865-hf9x
5+
url: http://www.openwall.com/lists/oss-security/2014/03/10/8
6+
title: Arabic Prawn allows remote attackers to execute arbitrary commands via shell
7+
metacharacters
8+
date: 2017-10-24
9+
description: "`lib/string_utf_support.rb` in the Arabic Prawn 0.0.1 gem for Ruby allows
10+
remote attackers to execute arbitrary commands via shell metacharacters in the (1)
11+
downloaded_file or (2) url variable."
12+
cvss_v2: 7.5
13+
notes: Never patched
14+
related:
15+
url:
16+
- url: https://nvd.nist.gov/vuln/detail/CVE-2014-2322
17+
- url: http://www.openwall.com/lists/oss-security/2014/03/10/8
18+
- url: http://www.openwall.com/lists/oss-security/2014/03/12/6
19+
- url: https://web.archive.org/web/20160306235714/http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html
20+
- url: https://github.com/advisories/GHSA-hgmw-x865-hf9x

‎gems/camaleon_cms/GHSA-3hp8-6j24-m5gm.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
gem: camaleon_cms
3+
ghsa: 3hp8-6j24-m5gm
4+
url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
5+
title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
6+
date: 2024-09-23
7+
description: |
8+
The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.
9+
10+
Arbitrary file deletion can be exploited with following code path:
11+
The parameter folder flows from the actions method:
12+
```ruby
13+
def actions
14+
authorize! :manage, :media if params[:media_action] != 'crop_url'
15+
params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
16+
case params[:media_action]
17+
[..]
18+
when 'del_file'
19+
cama_uploader.delete_file(params[:folder].gsub('//', '/'))
20+
render plain: ''
21+
```
22+
into the method delete_file of the CamaleonCmsLocalUploader
23+
class (when files are uploaded locally):
24+
```ruby
25+
def delete_file(key)
26+
file = File.join(@root_folder, key)
27+
FileUtils.rm(file) if File.exist? file
28+
@instance.hooks_run('after_delete', key)
29+
get_media_collection.find_by_key(key).take.destroy
30+
end
31+
```
32+
Where it is joined in an unchecked manner with the root folder and
33+
then deleted.
34+
35+
**Proof of concept**
36+
The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
37+
```
38+
curl --path-as-is -i -s -k -X $'POST' \
39+
-H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
40+
-b $'auth_token=[..]; _cms_session=[..]' \
41+
--data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
42+
2F..
43+
2F..
44+
2FREADME.md&media_action=del_file' \
45+
$'https://<camaleon-host>/admin/media/actions?actions=true'
46+
```
47+
48+
**Impact**
49+
50+
This issue may lead to a defective CMS or system.
51+
52+
**Remediation**
53+
54+
Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the
55+
targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.
56+
57+
**See also:**
58+
59+
[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
60+
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
61+
patched_versions:
62+
- ">= 2.8.1"
63+
related:
64+
url:
65+
- url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
66+
- url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml
67+
- url: https://github.com/advisories/GHSA-3hp8-6j24-m5gm

‎gems/fluentd-ui/CVE-2020-21514.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
gem: fluentd-ui
3+
cve: 2020-21514
4+
ghsa: wrxf-x8rm-6ggg
5+
url: https://github.com/fluent/fluentd/issues/2722
6+
title: Fluent Fluentd and Fluent-ui use default password
7+
date: 2023-04-04
8+
description: An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
9+
that allows attackers to gain escilated privileges and execute arbitrary code due
10+
to use of a default password.
11+
cvss_v3: 8.8
12+
notes: Never patched
13+
related:
14+
url:
15+
- url: https://nvd.nist.gov/vuln/detail/CVE-2020-21514
16+
- url: https://github.com/fluent/fluentd/issues/2722
17+
- url: https://github.com/advisories/GHSA-wrxf-x8rm-6ggg

‎gems/fluentd/CVE-2020-21514.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
gem: fluentd
3+
cve: 2020-21514
4+
ghsa: wrxf-x8rm-6ggg
5+
url: https://github.com/fluent/fluentd/issues/2722
6+
title: Fluent Fluentd and Fluent-ui use default password
7+
date: 2023-04-04
8+
description: An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
9+
that allows attackers to gain escilated privileges and execute arbitrary code due
10+
to use of a default password.
11+
cvss_v3: 8.8
12+
notes: Never patched
13+
related:
14+
url:
15+
- url: https://nvd.nist.gov/vuln/detail/CVE-2020-21514
16+
- url: https://github.com/fluent/fluentd/issues/2722
17+
- url: https://github.com/advisories/GHSA-wrxf-x8rm-6ggg

‎gems/nokogiri/GHSA-fq42-c5rg-92c2.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
gem: nokogiri
3+
ghsa: fq42-c5rg-92c2
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
5+
title: Vulnerable dependencies in Nokogiri
6+
date: 2022-02-25
7+
description: |
8+
### Summary
9+
10+
Nokogiri [v1.13.2](https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2) upgrades two of its packaged dependencies:
11+
12+
- vendored libxml2 from v2.9.12 to [v2.9.13](https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news)
13+
- vendored libxslt from v1.1.34 to [v1.1.35](https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news)
14+
15+
Those library versions address the following upstream CVEs:
16+
17+
- libxslt: [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) (CVSS 8.8, High severity)
18+
- libxml2: [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308) (Unspecified severity, see more information below)
19+
20+
Those library versions also address numerous other issues including performance improvements, regression fixes, and bug fixes, as well as memory leaks and other use-after-free issues that were not assigned CVEs.
21+
22+
Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.2`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.
23+
24+
25+
### Mitigation
26+
27+
Upgrade to Nokogiri `>= 1.13.2`.
28+
29+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link an older version Nokogiri against external libraries libxml2 `>= 2.9.13` and libxslt `>= 1.1.35`, which will also address these same CVEs.
30+
31+
32+
### Impact
33+
34+
#### libxslt [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560)
35+
36+
- CVSS3 score: 8.8 (High)
37+
- Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c
38+
39+
All versions of libxslt prior to v1.1.35 are affected.
40+
41+
Applications using **untrusted** XSL stylesheets to transform XML are vulnerable to a denial-of-service attack and should be upgraded immediately.
42+
43+
44+
#### libxml2 [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308)
45+
46+
- As of the time this security advisory was published, there is no officially published information available about this CVE's severity. The above NIST link does not yet have a published record, and the libxml2 maintainer has declined to provide a severity score.
47+
- Fixed by https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12
48+
- Further explanation is at https://mail.gnome.org/archives/xml/2022-February/msg00015.html
49+
50+
The upstream commit and the explanation linked above indicate that an application may be vulnerable to a denial of service, memory disclosure, or code execution if it parses an **untrusted** document with parse options `DTDVALID` set to true, and `NOENT` set to false.
51+
52+
An analysis of these parse options:
53+
54+
- While `NOENT` is off by default for Document, DocumentFragment, Reader, and Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri v1.12.0 and later.
55+
- `DTDVALID` is an option that Nokogiri does not set for any operations, and so this CVE applies only to applications setting this option explicitly.
56+
57+
It seems reasonable to assume that any application explicitly setting the parse option `DTDVALID` when parsing **untrusted** documents is vulnerable and should be upgraded immediately.
58+
cvss_v3: 8.8
59+
patched_versions:
60+
- ">= 1.13.2"
61+
related:
62+
url:
63+
- url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
64+
- url: https://github.com/advisories/GHSA-fq42-c5rg-92c2

‎gems/nokogiri/GHSA-gx8x-g87m-h5q6.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
gem: nokogiri
3+
ghsa: gx8x-g87m-h5q6
4+
url: https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
5+
title: Denial of Service (DoS) in Nokogiri on JRuby
6+
date: 2022-04-11
7+
description: |
8+
## Summary
9+
10+
Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).
11+
12+
See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.
13+
14+
Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.
15+
16+
17+
## Mitigation
18+
19+
Upgrade to Nokogiri `>= 1.13.4`.
20+
21+
22+
## Impact
23+
24+
### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml
25+
26+
- **Severity**: High 7.5
27+
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
28+
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
29+
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
30+
cvss_v3: 7.5
31+
patched_versions:
32+
- ">= 1.13.4"
33+
related:
34+
url:
35+
- url: https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv
36+
- url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6
37+
- url: https://nvd.nist.gov/vuln/detail/CVE-2022-24839
38+
- url: https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d
39+
- url: https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
40+
- url: https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
41+
- url: https://github.com/advisories/GHSA-gx8x-g87m-h5q6

‎gems/nokogiri/GHSA-v6gp-9mmm-c6p5.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: nokogiri
3+
ghsa: v6gp-9mmm-c6p5
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
5+
title: Out-of-bounds Write in zlib affects Nokogiri
6+
date: 2022-04-11
7+
description: "## Summary\n\nNokogiri v1.13.4 updates the vendored zlib from 1.2.11
8+
to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032).
9+
That CVE is scored as CVSS 7.4 \"High\" on the NVD record as of 2022-04-05.\n\nPlease
10+
note that this advisory only applies to the CRuby implementation of Nokogiri `<
11+
1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this
12+
document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby)
13+
for a complete description of which platform gems vendor `zlib`. If you've overridden
14+
defaults at installation time to use system libraries instead of packaged libraries,
15+
you should instead pay attention to your distro's `zlib` release announcements.
16+
\n\n## Mitigation\n\nUpgrade to Nokogiri `>= v1.13.4`.\n\n## Impact\n\n### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032)
17+
in zlib\n\n- **Severity**: High\n- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html)
18+
Out of bounds write\n- **Description**: zlib before 1.2.12 allows memory corruption
19+
when deflating (i.e., when compressing) if the input has many distant matches.\n\n"
20+
cvss_v3: 7.5
21+
patched_versions:
22+
- ">= 1.13.4"
23+
related:
24+
url:
25+
- url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
26+
- url: https://nvd.nist.gov/vuln/detail/CVE-2018-25032
27+
- url: https://github.com/advisories/GHSA-jc36-42cf-vqwj
28+
- url: https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4
29+
- url: https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer
30+
- url: https://github.com/advisories/GHSA-v6gp-9mmm-c6p5

‎gems/nokogiri/GHSA-vcc3-rw6f-jv97.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
gem: nokogiri
3+
ghsa: vcc3-rw6f-jv97
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
5+
title: Use-after-free in libxml2 via Nokogiri::XML::Reader
6+
date: 2024-03-18
7+
description: |
8+
### Summary
9+
10+
Nokogiri upgrades its dependency libxml2 as follows:
11+
- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
12+
- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4
13+
14+
libxml2 v2.11.7 and v2.12.5 address the following vulnerability:
15+
16+
CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
17+
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
18+
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
19+
20+
Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
21+
the packaged libraries are being used. If you've overridden defaults at installation time to use
22+
system libraries instead of packaged libraries, you should instead pay attention to your distro's
23+
libxml2 release announcements.
24+
25+
JRuby users are not affected.
26+
27+
### Severity
28+
29+
The Nokogiri maintainers have evaluated this as **Moderate**.
30+
31+
### Impact
32+
33+
From the CVE description, this issue applies to the `xmlTextReader` module (which underlies
34+
`Nokogiri::XML::Reader`):
35+
36+
> When using the XML Reader interface with DTD validation and XInclude expansion enabled,
37+
> processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
38+
39+
### Mitigation
40+
41+
Upgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.
42+
43+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
44+
and link Nokogiri against patched external libxml2 libraries which will also address these same
45+
issues.
46+
cvss_v3: 7.5
47+
patched_versions:
48+
- "~> 1.15.6"
49+
- ">= 1.16.2"
50+
related:
51+
url:
52+
- url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
53+
- url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml
54+
- url: https://github.com/advisories/GHSA-vcc3-rw6f-jv97

0 commit comments

Comments
 (0)