CVE-2022-23308: Use After Free

February 26, 2022 (updated November 9, 2023)

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes, which is vendored in Nokogiri before 1.13.2.

References

github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
github.com/sparklemotion/nokogiri/releases/tag/v1.13.2
gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS
nvd.nist.gov/vuln/detail/CVE-2022-23308

Code Behaviors & Features

Detect and mitigate CVE-2022-23308 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →