NULL Pointer Dereference in Nokogiri via libxml2

Executive Summary

Nokogiri before version 1.14.3 (CRuby only with packaged libxml2) includes libxml2 v2.10.3 which has NULL pointer dereference flaws in XML Schema processing functions (xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK). A crafted XML schema can trigger these flaws, causing libxml2 to crash via a NULL pointer dereference, leading to denial of service.

Useful 0 Not Useful 0

Detection Guidance

Check Nokogiri version with gem list nokogiri. If version is less than 1.14.3, it is vulnerable. Also verify libxml2 version if using packaged libraries.

Useful 0 Not Useful 0

Impact Analysis

If you use Nokogiri < 1.14.3 with its bundled libxml2, an attacker could supply a malformed XML schema to crash your application via a segmentation fault, disrupting service. This only affects CRuby implementations using packaged libraries, not those linked to system libxml2.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service through crashes, which may impact availability of systems processing XML data. GDPR and HIPAA require maintaining data availability and integrity, so repeated crashes could lead to compliance issues if they disrupt critical operations. However, the vulnerability does not directly expose or leak data, so confidentiality requirements are not directly affected.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nokogiri to version 1.14.3 or higher. If unable to upgrade, compile against an external libxml2 version 2.10.4 or higher.

Useful 0 Not Useful 0