GHSA-r3w4-36x6-7r99: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

May 14, 2024

Nokogiri v1.16.5 upgrades its dependency libxml2 to 2.12.7 from 2.12.6.

libxml2 v2.12.7 addresses CVE-2024-34459:

described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53

References

github.com/advisories/GHSA-r3w4-36x6-7r99
github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml
github.com/sparklemotion/nokogiri
github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7
gitlab.gnome.org/GNOME/libxml2/-/issues/720

Code Behaviors & Features

Detect and mitigate GHSA-r3w4-36x6-7r99 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →