CVE-2022-24836: Inefficient Regular Expression Complexity in Nokogiri
Summary
Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.
Mitigation
Upgrade to Nokogiri >= 1.13.4.
Severity
The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
References
CWE-1333 Inefficient Regular Expression Complexity
Credit
This vulnerability was reported by HackerOne user oooooooq (ななおく).
Other sources
A flaw was found in the nokogiri library when processing an inefficient and complex regular expression. This flaw allows an attacker to cause excessive consumption of resources, which affects performance.
Accounts. This issue was addressed with improved data protection.
— Apple
AMD. A memory corruption issue was addressed with improved input validation.
— Apple
AMD. An out-of-bounds write issue was addressed with improved input validation.
— Apple
AppleMobileFileIntegrity. This issue was addressed by enabling hardened runtime.
— Apple
Credit
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2022-42843
- CVE-2022-42858
- CVE-2022-42847
- CVE-2022-42865
- CVE-2022-42854
- CVE-2022-42853
- CVE-2022-42859
- CVE-2022-35252
- CVE-2022-32942
- CVE-2022-46720
- CVE-2022-46710
- CVE-2022-46693
- CVE-2022-42864
- CVE-2022-46690
- CVE-2022-46697
- CVE-2022-42837
- CVE-2022-46689
- CVE-2022-46701
- CVE-2022-42842
- CVE-2022-42861
- CVE-2022-42845
- CVE-2022-48618
- CVE-2022-42839
- CVE-2022-46716
- CVE-2022-46704
- CVE-2022-32943
- CVE-2022-42840
- CVE-2022-42855
- CVE-2022-42862
- CVE-2022-24836
- CVE-2022-29181
- CVE-2022-46695
- CVE-2022-46718
- CVE-2022-46703
- CVE-2022-42866
- CVE-2022-32919
- CVE-2022-46725
- CVE-2022-46705
- CVE-2022-42867
- CVE-2022-46691
- CVE-2022-46692
- CVE-2022-42852
- CVE-2022-46696
- CVE-2022-46700
- CVE-2022-46698
- CVE-2022-46699
- CVE-2022-42863
- CVE-2022-42856
- CVE-2022-42841
- CVE-2022-43454
- CVE-2022-48610
Frequently Asked Questions
What is CVE-2022-24836?
CVE-2022-24836 is a vulnerability in Nokogiri < v1.13.4 that allows for excessive backtracking when attempting to detect encoding in HTML documents.
How can I mitigate the CVE-2022-24836 vulnerability?
To mitigate the CVE-2022-24836 vulnerability, upgrade to Nokogiri >= 1.13.4.
What is the severity of CVE-2022-24836?
CVE-2022-24836 has a severity rating of high.
What software is affected by CVE-2022-24836?
The affected software includes Nokogiri < 1.13.4, macOS Ventura 13.1, rubygem-nokogiri 0:1.13.8-1.el8, and redhat/nokogiri.
Where can I find more information about CVE-2022-24836?
You can find more information about CVE-2022-24836 on the following references: - Apple Support: [https://support.apple.com/en-us/HT213532](https://support.apple.com/en-us/HT213532) - GitHub Security Advisory: [https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8) - NVD: [https://nvd.nist.gov/vuln/detail/CVE-2022-24836](https://nvd.nist.gov/vuln/detail/CVE-2022-24836)