CVE-2022-24839: Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
Summary
The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.
Severity
The maintainers have evaluated this as High Severity 7.5 (CVSS3.1).
Mitigation
Upgrade to >= 1.9.22.noko2.
Credit
This vulnerability was reported by 이형관 (windshock).
References
CWE-400 Uncontrolled Resource Consumption
Notes
The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Other sources
org.cyberneko.html is an html parser written in Java. The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup. Users are advised to upgrade to >= 1.9.22.noko2. Note: The upstream library org.cyberneko.html is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
Sparkle Motion Nokogiri is vulnerable to a denial of service, caused by a java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup in the fork of org.cyberneko.html. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-24839.
What is the severity of CVE-2022-24839?
The severity of CVE-2022-24839 is high with a score of 7.5.
Which software products are affected by CVE-2022-24839?
The affected software products include IBM Cloud Transformation Advisor, Nekohtml Project Nekohtml, Oracle WebLogic Server 12.2.1.3.0, Oracle WebLogic Server 12.2.1.4.0, and Oracle WebLogic Server 14.1.1.0.0.
How can I fix CVE-2022-24839?
To fix CVE-2022-24839, upgrade to Nokogiri version >= 1.9.22.noko2 for Nekohtml Project Nekohtml, or follow the patch remedy provided by your software vendor.
Where can I find more information about CVE-2022-24839?
More information about CVE-2022-24839 can be found in the references: [1](https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d), [2](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv), [3](https://www.oracle.com/security-alerts/cpujul2022.html).