Re: Nokogiri security update v1.10.4

congraduations.

在 2019/8/12 3:51, Mike Dalessio 写道:
> Nokogiri 1.10.4 has been released.
> 
> This is a security release. Summary details are below, and full details 
> are at https://github.com/sparklemotion/nokogiri/issues/1915
> 
> ---
> 
> ## 1.10.4 / 2019-08-11
> 
> ### Security
> 
> #### Address CVE-2019-5477 (#1915)
> 
> A command injection vulnerability in Nokogiri v1.10.3 and earlier allows 
> commands to be executed in a subprocess by Ruby's `Kernel.open` method. 
> Processes are vulnerable only if the undocumented method 
> `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input.
> 
> This vulnerability appears in code generated by the Rexical gem versions 
> v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical 
> scanner code for parsing CSS queries. The underlying vulnerability was 
> addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of 
> Rexical in Nokogiri v1.10.4.
> 
> This CVE's public notice is 
> https://github.com/sparklemotion/nokogiri/issues/1915
> 
> 
> 
> 
> Unsubscribe: <mailto:[email protected]?subject=unsubscribe>
> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>
> 

Unsubscribe: <mailto:[email protected]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>