Vulnerability in Apple macOS
CVE-2022-29181
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
EPSS: 0.032 (87.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.
Affected products
- Apple Macos
- Nokogiri
- Sparklemotion Nokogiri — versions < 1.13.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_MISC)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Exploit, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-29181?
- CVE-2022-29181 is a high-severity vulnerability in Apple macOS, classified under CWE-241. CVSS score: 8.2/10. Published 2022-05-20.
- How severe is CVE-2022-29181?
- High severity. CVSS v3 base score is 8.2 out of 10.