evaluate upstream libxslt patches mentioned in USN-3271-1 #1634

flavorjones · 2017-04-28T17:22:47Z

This issue is to drive investigation and potential action around a set of upstream libxslt patches that Canonical judged valuable enough to port to their distributions.

USN-3271-1

"libxslt vulnerabilities"

https://www.ubuntu.com/usn/usn-3271-1/

CVE-2017-5029

http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html

priority: medium

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux
and 57.0.2987.108 for Android, lacked a check for integer overflow during a
size calculation, which allowed a remote attacker to perform an out of
bounds memory write via a crafted HTML page.

patches:

(unreleased upstream) https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5

CVE-2016-1683

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1683.html

priority: medium

numbers.c in libxslt before 1.1.29, as used in Google Chrome before
51.0.2704.63, mishandles namespace nodes, which allows remote attackers to
cause a denial of service (out-of-bounds heap memory access) or possibly
have unspecified other impact via a crafted document.

patches:

(in libxslt 1.1.29) https://git.gnome.org/browse/libxslt/commit/?id=d182d8f6ba3071503d96ce17395c9d55871f0242

CVE-2016-1841

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1841.html

priority: medium

libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS
before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via a
crafted web site.

patches:

(in libxslt 1.1.29) https://git.gnome.org/browse/libxslt/commit/?id=fc1ff481fd01e9a65a921c542fed68d8c965e8a3

CVE-2015-7995

http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7995.html

priority: low

The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not
check if the parent node is an element, which allows attackers to cause a
denial of service via a crafted XML file, related to a "type confusion"
issue.

patches:

(in libxslt 1.1.29) https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617

CVE-2016-1684

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1684.html

priority: medium

numbers.c in libxslt before 1.1.29, as used in Google Chrome before
51.0.2704.63, mishandles the i format token for xsl:number data, which
allows remote attackers to cause a denial of service (integer overflow or
resource consumption) or possibly have unspecified other impact via a
crafted document.

patches:

(in libxslt 1.1.29) https://git.gnome.org/browse/libxslt/commit/?id=91d0540ac9beaa86719a05b749219a69baa0dd8d
(in libxslt 1.1.29) https://git.gnome.org/browse/libxslt/commit/?id=405034286fbdd6166229335b7203a41bf53b40fc

CVE-2016-4738

http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html

priority: medium

libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
watchOS before 3 allows remote attackers to execute arbitrary code or cause
a denial of service (memory corruption) via a crafted web site.

patches:

(unreleased upstream) https://git.gnome.org/browse/libxslt/commit/?id=eb1030de31165b68487f288308f9d1810fed6880

flavorjones · 2017-04-28T17:28:20Z

To focus the decision, there are only two patches in this set that were not in libxslt 1.1.29; the patch for CVE-2017-5029 (medium) and for CVE-2016-4738 (medium).

I'd like to port these to Nokogiri and cut v1.7.2 as a security release.

I'll do this in the next few days unless I hear compelling objections here in the next 24 hours.

to address CVE-2017-5029 and CVE-2016-4738. see #1634 for more information.

flavorjones · 2017-05-09T21:20:17Z

3c8d673 on the v1.7.x branch is green:

shipping it now.

flavorjones · 2017-05-09T21:28:53Z

v1.7.2 has been released with these patches.

to address CVE-2017-5029 and CVE-2016-4738. see #1634 for more information.

flavorjones · 2017-05-09T21:38:40Z

And merged into master. Closing.

sparklemotion/nokogiri#1634

This fixes a vulnerability, for more details see: sparklemotion/nokogiri#1634

A security alert was raised by gemnasium: Sources: sparklemotion/nokogiri#1634 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html

This fixes a [security issue with nokogiri v1.7.1](sparklemotion/nokogiri#1634)

@kares

# 1.8.0 / 2017-06-04 ## Backwards incompatibilities This release ends support for Ruby 2.1 on Windows in the `x86-mingw32` and `x64-mingw32` platform gems (containing pre-compiled DLLs). Official support ended for Ruby 2.1 on 2017-04-01. Please note that this deprecation note only applies to the precompiled Windows gems. Ruby 2.1 continues to be supported (for now) in the default gem when compiled on installation. ## Dependencies * [Windows] Upgrade iconv from 1.14 to 1.15 (unless --use-system-libraries) * [Windows] Upgrade zlib from 1.2.8 to 1.2.11 (unless --use-system-libraries) * [MRI] Upgrade rake-compiler dependency from 0.9.2 to 1.0.3 * [MRI] Upgrade mini-portile2 dependency from `~> 2.1.0` to `~> 2.2.0` ## Compatibility notes * [JRuby] Removed support for `jruby --1.8` code paths. [#1607] (Thanks, @kares!) * [MRI Windows] Retrieve zlib source from http://zlib.net/fossils to avoid deprecation issues going forward. See #1632 for details around this problem. ## Features * NodeSet#clone is not an alias for NodeSet#dup [#1503] (Thanks, @stephankaag!) * Allow Processing Instructions and Comments as children of a document root. [#1033] (Thanks, @windwiny!) * [MRI] PushParser#replace_entities and #replace_entities= will control whether entities are replaced or not. [#1017] (Thanks, @spraints!) * [MRI] SyntaxError#to_s now includes line number, column number, and log level if made available by the parser. [#1304, #1637] (Thanks, @spk and @ccarruitero!) * [MRI] Cross-built Windows gems now support Ruby 2.4 * [MRI] Support for frozen string literals. [#1413] * [MRI] Support for installing Nokogiri on a machine in FIPS-enabled mode [#1544] * [MRI] Vendored libraries are verified with SHA-256 hashes (formerly some MD5 hashes were used) [#1544] * [JRuby] (performance) remove unnecessary synchronization of class-cache [#1563] (Thanks, @kares!) * [JRuby] (performance) remove unnecessary cloning of objects in XPath searches [#1563] (Thanks, @kares!) * [JRuby] (performance) more performance improvements, particularly in XPath, Reader, XmlNode, and XmlNodeSet [#1597] (Thanks, @kares!) ## Bugs * HTML::SAX::Parser#parse_io now correctly parses HTML and not XML [#1577] (Thanks for the test case, @gregors!) * Support installation on systems with a `lib64` site config. [#1562] * [MRI] on OpenBSD, do not require gcc if using system libraries [#1515] (Thanks, @jeremyevans!) * [MRI] XML::Attr.new checks type of Document arg to prevent segfaults. [#1477] * [MRI] Prefer xmlCharStrdup (and friends) to strdup (and friends), which can cause problems on some platforms. [#1517] (Thanks, @jeremy!) * [JRuby] correctly append a text node before another text node [#1318] (Thanks, @jkraemer!) * [JRuby] custom xpath functions returning an integer now work correctly [#1595] (Thanks, @kares!) * [JRuby] serializing (`#to_html`, `#to_s`, et al) a document with explicit encoding now works correctly. [#1281, #1440] (Thanks, @kares!) * [JRuby] XML::Reader now returns parse errors [#1586] (Thanks, @kares!) * [JRuby] Empty NodeSets are now decorated properly. [#1319] (Thanks, @kares!) * [JRuby] Merged nodes no longer results in Java exceptions during XPath queries. [#1320] (Thanks, @kares!) # 1.7.2 / 2017-05-09 ## Security Notes [MRI] Upstream libxslt patches are applied to the vendored libxslt 1.1.29 which address CVE-2017-5029 and CVE-2016-4738. For more information: * sparklemotion/nokogiri#1634 * http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html * http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html

* Update Nokogiri to v1.8.0 Addresses security vulnerability: - [nokogiri issue 1615](sparklemotion/nokogiri#1615) - [nokogiri issue 1634](sparklemotion/nokogiri#1634)

The currently installed version has a security advisory: ``` Updated ruby-advisory-db ruby-advisory-db: 287 advisories Name: nokogiri Version: 1.7.1 Advisory: CVE-2017-5029 Criticality: Unknown URL: sparklemotion/nokogiri#1634 Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29 Solution: upgrade to >= 1.7.2 ```

* Travis is failing because ruby-advisory-db warning say nokogiri is out of date and has vulnerabilities. sparklemotion/nokogiri#1615 sparklemotion/nokogiri#1634 sparklemotion/nokogiri#1473 * Also updated capybara-webkit which uses nokogiri

to address CVE-2017-5029 and CVE-2016-4738. see sparklemotion#1634 for more information. Conflicts: CHANGELOG.rdoc

* Maybe I should write a script to automatically update nokogiri :) ruby-advisory-db: 288 advisories Name: nokogiri Version: 1.7.0.1 Advisory: CVE-2016-4658 Criticality: Unknown URL: sparklemotion/nokogiri#1615 Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt Solution: upgrade to >= 1.7.1 Name: nokogiri Version: 1.7.0.1 Advisory: CVE-2017-5029 Criticality: Unknown URL: sparklemotion/nokogiri#1634 Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29 Solution: upgrade to >= 1.7.2 Name: nokogiri Version: 1.7.0.1 Advisory: CVE-2017-9050 Criticality: Unknown URL: sparklemotion/nokogiri#1673 Title: Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities Solution: upgrade to >= 1.8.1

…n/nokogiri#1673) and CVE-2017-5029 (sparklemotion/nokogiri#1634)

…otion/nokogiri#1673) and [CVE-2017-5029](sparklemotion/nokogiri#1634) Added branch on my fork of savon until PR savonrb/savon#848 has been merged

…n/nokogiri#1673) and CVE-2017-5029 (sparklemotion/nokogiri#1634) (#848)

Name: actionview Version: 4.2.6 Advisory: CVE-2016-6316 URL: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk Title: Possible XSS Vulnerability in Action View Solution: upgrade to ~> 4.2.7.1, ~> 4.2.8, >= 5.0.0.1 Name: activerecord Version: 4.2.6 Advisory: CVE-2016-6317 URL: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s Title: Unsafe Query Generation Risk in Active Record Solution: upgrade to >= 4.2.7.1 Name: nokogiri Version: 1.6.7.2 Advisory: CVE-2017-9050 URL: sparklemotion/nokogiri#1673 Title: Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities Solution: upgrade to >= 1.8.1 Name: nokogiri Version: 1.6.7.2 Advisory: CVE-2016-4658 URL: sparklemotion/nokogiri#1615 Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt Solution: upgrade to >= 1.7.1 Name: nokogiri Version: 1.6.7.2 Advisory: CVE-2015-8806 URL: sparklemotion/nokogiri#1473 Title: Denial of service or RCE from libxml2 and libxslt Solution: upgrade to >= 1.6.8 Name: nokogiri Version: 1.6.7.2 Advisory: CVE-2017-5029 URL: sparklemotion/nokogiri#1634 Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29 Solution: upgrade to >= 1.7.2

Note that this upgrade changes minimum required ruby version from 1.9.3-p551 to 2.1.8. ``` $ bundle audit check Name: nokogiri Version: 1.6.8.1 Advisory: CVE-2016-4658 Criticality: Unknown URL: sparklemotion/nokogiri#1615 Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt Solution: upgrade to >= 1.7.1 Name: nokogiri Version: 1.6.8.1 Advisory: CVE-2017-5029 Criticality: Unknown URL: sparklemotion/nokogiri#1634 Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29 Solution: upgrade to >= 1.7.2 Name: nokogiri Version: 1.6.8.1 Advisory: CVE-2016-4658 Criticality: Unknown URL: sparklemotion/nokogiri#1615 Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt Solution: upgrade to >= 1.7.1 Name: nokogiri Version: 1.6.8.1 Advisory: CVE-2017-5029 Criticality: Unknown URL: sparklemotion/nokogiri#1634 Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29 Solution: upgrade to >= 1.7.2 Vulnerabilities found! ```

Earlier versions of Nokogiri have security issues as follows: [CVE-2016-4658](sparklemotion/nokogiri#1615) [CVE-2017-5029](sparklemotion/nokogiri#1634) [CVE-2017-9050](sparklemotion/nokogiri#1673) [CVE-2017-16932](sparklemotion/nokogiri#1714) [CVE-2017-15412](sparklemotion/nokogiri#1714)

flavorjones added vendored/libxslt topic/security labels Apr 28, 2017

flavorjones added a commit that referenced this issue May 9, 2017

apply upstream libxslt patches

0859c48

to address CVE-2017-5029 and CVE-2016-4738. see #1634 for more information.

flavorjones added a commit that referenced this issue May 9, 2017

apply upstream libxslt patches

4afcbbf

to address CVE-2017-5029 and CVE-2016-4738. see #1634 for more information.

flavorjones closed this as completed May 9, 2017

oliverguenther added a commit to opf/openproject that referenced this issue May 10, 2017

Bump nokogiri

33db709

sparklemotion/nokogiri#1634

oliverguenther mentioned this issue May 10, 2017

Bump nokogiri opf/openproject#5466

Merged

infertux added a commit to buckybox/webstore that referenced this issue May 10, 2017

Update nokogiri Gem

b627002

sparklemotion/nokogiri#1634

infertux added a commit to buckybox/core that referenced this issue May 10, 2017

Update nokogiri Gem

368767a

sparklemotion/nokogiri#1634

cantino mentioned this issue May 11, 2017

Update Nokogiri to 1.7.2 huginn/huginn#2000

Merged

dreamfall added a commit to bitzesty/qae that referenced this issue May 15, 2017

update nokogiri

67350c4

sparklemotion/nokogiri#1634

dreamfall mentioned this issue May 15, 2017

update nokogiri gem bitzesty/qae#1244

Merged

DarthHater mentioned this issue May 15, 2017

Update nokogiri to 1.7.2 DARIAEngineering/dcaf_case_management#1057

Merged

amatriain added a commit to amatriain/feedbunch that referenced this issue May 15, 2017

Updated nokogiri 1.7.1 -> 1.7.2

1034657

This fixes a vulnerability, for more details see: sparklemotion/nokogiri#1634

jsugarman mentioned this issue May 17, 2017

bump nokogiri 1.7.1 --> 1.7.2 ministryofjustice/peoplefinder#558

Merged

md5 mentioned this issue May 20, 2017

Update gems codeforamerica/ohana-api#423

Merged

andrecedik added a commit to shipcloud/shipcloud-developer-portal that referenced this issue May 22, 2017

update html-proofer gem

70b0850

This fixes a [security issue with nokogiri v1.7.1](sparklemotion/nokogiri#1634)

tlehman mentioned this issue May 22, 2017

Upgrade to nokogiri 1.7.2 goldstar/hide_and_seek#4

Merged

zammad-sync pushed a commit to zammad/zammad that referenced this issue Jun 12, 2017

Updated nokogiri to 1.8.0 (see sparklemotion/nokogiri#1634).

c1aa57f

zammad-sync pushed a commit to zammad/zammad that referenced this issue Jun 13, 2017

Updated nokogiri to 1.8.0 (see sparklemotion/nokogiri#1634).

427f06a

amoose mentioned this issue Jun 13, 2017

CVE-2017-5029 in nokogiri fugacious/fugacious#128

Closed

zammad-sync pushed a commit to zammad/zammad that referenced this issue Jun 13, 2017

Updated nokogiri to 1.8.0 (see sparklemotion/nokogiri#1634).

3aebb77

alexcopquin mentioned this issue Jun 14, 2017

nokogiri security issues 1615 & 1634 dandemeyere/responsys-api#44

Closed

This was referenced Jun 15, 2017

Update nokogiri to v 1.8.0 dandemeyere/responsys-api#45

Closed

Update nokogiri 1.8.0 dandemeyere/responsys-api#46

Merged

semipermeable pushed a commit to solanolabs/nokogiri that referenced this issue Aug 30, 2017

apply upstream libxslt patches

29bed4c

to address CVE-2017-5029 and CVE-2016-4738. see sparklemotion#1634 for more information. Conflicts: CHANGELOG.rdoc

AdrianCann mentioned this issue Oct 1, 2017

Update nokogiri based on ruby advisory sophomoric/maddie#57

Merged

alebruck mentioned this issue Oct 31, 2017

Nokogiri gem needs to be updated blackducksoftware/ohloh-ui#1257

Closed

michael-harrison pushed a commit to michael-harrison/savon that referenced this issue Dec 6, 2017

Updated nokogiri to mitigate vulnerabilities USN-3424-1 (sparklemotio…

5f6f9d8

…n/nokogiri#1673) and CVE-2017-5029 (sparklemotion/nokogiri#1634)

This was referenced Dec 6, 2017

hotfix/nokogiri_vulnerbility_USN-3424-1 savonrb/savon#848

Merged

hotfix/nokogiri_vulnerbility_USN-3424-1 michael-harrison/savon#2

Merged

pcai pushed a commit to savonrb/savon that referenced this issue Dec 7, 2017

Updated nokogiri to mitigate vulnerabilities USN-3424-1 (sparklemotio…

85104ae

…n/nokogiri#1673) and CVE-2017-5029 (sparklemotion/nokogiri#1634) (#848)

havenwood mentioned this issue Dec 7, 2017

Bump Rails, Nokogiri, and related gem versions to address CVEs square/connect-api-examples#46

Merged

fedegratti mentioned this issue Dec 9, 2017

Update gitgub_api dependency to prevent security problems basecamp/trix#467

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

evaluate upstream libxslt patches mentioned in USN-3271-1 #1634

evaluate upstream libxslt patches mentioned in USN-3271-1 #1634

flavorjones commented Apr 28, 2017 •

edited

Loading

flavorjones commented Apr 28, 2017

flavorjones commented May 9, 2017

flavorjones commented May 9, 2017

flavorjones commented May 9, 2017

evaluate upstream libxslt patches mentioned in USN-3271-1 #1634

evaluate upstream libxslt patches mentioned in USN-3271-1 #1634

Comments

flavorjones commented Apr 28, 2017 • edited Loading

USN-3271-1

CVE-2017-5029

CVE-2016-1683

CVE-2016-1841

CVE-2015-7995

CVE-2016-1684

CVE-2016-4738

flavorjones commented Apr 28, 2017

flavorjones commented May 9, 2017

flavorjones commented May 9, 2017

flavorjones commented May 9, 2017

flavorjones commented Apr 28, 2017 •

edited

Loading