CVE-2019-5477
Fixed in a distro release EPSS 6%
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
Products: nokogiri, canonical ubuntu_linux, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | nokogiri | 1.10.4 |
| RubyGems | rexical | 1.0.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | rexical | 1.0.5-2+deb10u1 |
| Debian 10 | ruby-nokogiri | 1.10.0+dfsg1-2+deb10u1 |
| Debian 12 | rexical | 1.0.7-1 |
| Debian 12 | ruby-nokogiri | 1.10.4+dfsg1-1 |
| Debian 13 | rexical | 1.0.7-1 |
| Debian 13 | ruby-nokogiri | 1.10.4+dfsg1-1 |
| Debian 14 | rexical | 1.0.7-1 |
| Debian 14 | ruby-nokogiri | 1.10.4+dfsg1-1 |
| Debian 8 | ruby-nokogiri | 1.6.3.1+ds-1+deb8u1 |
| SUSE Enterprise Storage 4 | crowbar-core | 4.0+git.1570463621.40b11cd48-9.54.1 |
| SUSE Enterprise Storage 4 | rubygem-chef | 10.32.2-5.12.1 |
| SUSE Enterprise Storage 4 | rubygem-easy_diff | 1.0.0-3.3.1 |
| SUSE Enterprise Storage 4 | sleshammer | 0.7.0-0.18.12.3 |
| SUSE HPE Helion OpenStack 8 | ardana-ansible | 8.0+git.1566374355.c509923-3.67.3 |
| SUSE HPE Helion OpenStack 8 | ardana-glance | 8.0+git.1566376789.be0fe01-3.17.3 |
| SUSE HPE Helion OpenStack 8 | ardana-horizon | 8.0+git.1565816064.5d4f73f-3.18.3 |
| SUSE HPE Helion OpenStack 8 | ardana-input-model | 8.0+git.1566517401.98450e6-3.33.3 |
| SUSE HPE Helion OpenStack 8 | ardana-manila | 8.0+git.1568835837.2452e7a-1.21.3 |
| SUSE HPE Helion OpenStack 8 | ardana-neutron | 8.0+git.1568220097.74ee4b4-3.33.3 |
| SUSE HPE Helion OpenStack 8 | ardana-nova | 8.0+git.1566902754.c58ff69-3.35.3 |
| SUSE HPE Helion OpenStack 8 | ardana-octavia | 8.0+git.1568373448.bcaee7e-3.20.3 |
| SUSE HPE Helion OpenStack 8 | ardana-tempest | 8.0+git.1566471887.fd2fec7-3.27.3 |
| SUSE HPE Helion OpenStack 8 | galera-3 | 25.3.25-4.6.3 |
| SUSE HPE Helion OpenStack 8 | grafana | 4.6.5-4.6.3 |
| SUSE HPE Helion OpenStack 8 | mariadb | 10.2.25-4.14.2 |
| SUSE HPE Helion OpenStack 8 | mariadb-connector-c | 3.1.2-3.12.3 |
| SUSE HPE Helion OpenStack 8 | novnc | 1.0.0-3.6.3 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder | 11.2.3~dev16-3.21.4 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder-doc | 11.2.3~dev16-3.21.3 |
| SUSE HPE Helion OpenStack 8 | openstack-glance | 15.0.3~dev3-3.12.4 |
| SUSE HPE Helion OpenStack 8 | openstack-glance-doc | 15.0.3~dev3-3.12.3 |
| SUSE HPE Helion OpenStack 8 | openstack-heat | 9.0.8~dev13-3.24.4 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-doc | 9.0.8~dev13-3.24.3 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-neutron-vpnaas-ui | 1.0.1~dev3-3.6.4 |
| SUSE HPE Helion OpenStack 8 | openstack-keystone | 12.0.4~dev4-5.27.4 |
| SUSE HPE Helion OpenStack 8 | openstack-keystone-doc | 12.0.4~dev4-5.27.3 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-installer | 20190923_16.32-3.9.3 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron | 11.0.9~dev51-3.24.5 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-doc | 11.0.9~dev51-3.24.4 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-gbp | 7.3.1~dev56-3.9.4 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-lbaas | 11.0.4~dev6-3.15.4 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-lbaas-doc | 11.0.4~dev6-3.15.4 |
| SUSE HPE Helion OpenStack 8 | openstack-nova | 16.1.9~dev7-3.29.3 |
| SUSE HPE Helion OpenStack 8 | openstack-nova-doc | 16.1.9~dev7-3.29.3 |
| SUSE HPE Helion OpenStack 8 | python-amqp | 2.2.2-3.6.3 |
| SUSE HPE Helion OpenStack 8 | python-pysaml2 | 4.0.2-5.3.3 |
| SUSE HPE Helion OpenStack 8 | python-python-engineio | 2.0.2-3.3.3 |
| SUSE HPE Helion OpenStack 8 | python-urllib3 | 1.22-5.9.3 |
| SUSE HPE Helion OpenStack 8 | release-notes-hpe-helion-openstack | 8.20190911-3.20.3 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.1.1~dev7-12.20.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.21.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.18.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.2.3~dev16-14.21.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.19.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.16.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.3~dev3-12.19.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev13-12.21.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.4~dev6-14.26.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.8~dev7-12.21.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.4~dev4-11.22.3 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.20.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.1.1~dev2-12.23.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.18.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.16.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev2-12.16.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev51-13.24.3 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev7-11.22.3 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev2-12.21.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.4~dev1-11.20.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-swift | 2.15.2-11.13.3 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.1~dev13-11.20.2 |
| SUSE Linux Enterprise High Availability Extension 15 | rubygem-nokogiri | 1.8.5-3.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | rubygem-nokogiri | 1.8.5-3.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | rubygem-nokogiri | 1.8.5-3.6.1 |
| SUSE OpenStack Cloud 7 | crowbar-core | 4.0+git.1570463621.40b11cd48-9.54.1 |
| SUSE OpenStack Cloud 7 | crowbar-openstack | 4.0+git.1569429513.e7016b2b6-9.59.1 |
| SUSE OpenStack Cloud 7 | grafana | 4.6.5-1.11.2 |
| SUSE OpenStack Cloud 7 | novnc | 1.0.0-12.1 |
| SUSE OpenStack Cloud 7 | openstack-keystone | 10.0.3~dev9-7.18.2 |
| SUSE OpenStack Cloud 7 | openstack-keystone-doc | 10.0.3~dev9-7.18.2 |
| SUSE OpenStack Cloud 7 | openstack-neutron | 9.4.2~dev21-7.32.1 |
| SUSE OpenStack Cloud 7 | openstack-neutron-doc | 9.4.2~dev21-7.32.1 |
| SUSE OpenStack Cloud 7 | openstack-neutron-lbaas | 9.2.2~dev11-4.18.3 |
| SUSE OpenStack Cloud 7 | openstack-neutron-lbaas-doc | 9.2.2~dev11-4.18.3 |
| SUSE OpenStack Cloud 7 | openstack-nova | 14.0.11~dev13-4.34.3 |
| SUSE OpenStack Cloud 7 | openstack-nova-doc | 14.0.11~dev13-4.34.2 |
| SUSE OpenStack Cloud 7 | openstack-tempest | 12.2.1~a0~dev177-4.6.3 |
| SUSE OpenStack Cloud 7 | python-pysaml2 | 4.0.2-3.11.3 |
| SUSE OpenStack Cloud 7 | python-urllib3 | 1.16-3.9.2 |
| SUSE OpenStack Cloud 7 | rubygem-chef | 10.32.2-5.12.1 |
| SUSE OpenStack Cloud 7 | rubygem-easy_diff | 1.0.0-3.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-nokogiri | 1.6.1-5.3.1 |
| SUSE OpenStack Cloud 7 | sleshammer | 0.7.0-0.18.12.3 |
| SUSE OpenStack Cloud 8 | ardana-ansible | 8.0+git.1566374355.c509923-3.67.3 |
| SUSE OpenStack Cloud 8 | ardana-glance | 8.0+git.1566376789.be0fe01-3.17.3 |
| SUSE OpenStack Cloud 8 | ardana-horizon | 8.0+git.1565816064.5d4f73f-3.18.3 |
| SUSE OpenStack Cloud 8 | ardana-input-model | 8.0+git.1566517401.98450e6-3.33.3 |
| SUSE OpenStack Cloud 8 | ardana-manila | 8.0+git.1568835837.2452e7a-1.21.3 |
| SUSE OpenStack Cloud 8 | ardana-neutron | 8.0+git.1568220097.74ee4b4-3.33.3 |
| SUSE OpenStack Cloud 8 | ardana-nova | 8.0+git.1566902754.c58ff69-3.35.3 |
| SUSE OpenStack Cloud 8 | ardana-octavia | 8.0+git.1568373448.bcaee7e-3.20.3 |
| SUSE OpenStack Cloud 8 | ardana-tempest | 8.0+git.1566471887.fd2fec7-3.27.3 |
| SUSE OpenStack Cloud 8 | galera-3 | 25.3.25-4.6.3 |
| SUSE OpenStack Cloud 8 | grafana | 4.6.5-4.6.3 |
| SUSE OpenStack Cloud 8 | mariadb | 10.2.25-4.14.2 |
| SUSE OpenStack Cloud 8 | mariadb-connector-c | 3.1.2-3.12.3 |
| SUSE OpenStack Cloud 8 | novnc | 1.0.0-3.6.3 |
| SUSE OpenStack Cloud 8 | openstack-cinder | 11.2.3~dev16-3.21.4 |
| SUSE OpenStack Cloud 8 | openstack-cinder-doc | 11.2.3~dev16-3.21.3 |
| SUSE OpenStack Cloud 8 | openstack-glance | 15.0.3~dev3-3.12.4 |
| SUSE OpenStack Cloud 8 | openstack-glance-doc | 15.0.3~dev3-3.12.3 |
| SUSE OpenStack Cloud 8 | openstack-heat | 9.0.8~dev13-3.24.4 |
| SUSE OpenStack Cloud 8 | openstack-heat-doc | 9.0.8~dev13-3.24.3 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-neutron-vpnaas-ui | 1.0.1~dev3-3.6.4 |
| SUSE OpenStack Cloud 8 | openstack-keystone | 12.0.4~dev4-5.27.4 |
| SUSE OpenStack Cloud 8 | openstack-keystone-doc | 12.0.4~dev4-5.27.3 |
| SUSE OpenStack Cloud 8 | openstack-monasca-installer | 20190923_16.32-3.9.3 |
| SUSE OpenStack Cloud 8 | openstack-neutron | 11.0.9~dev51-3.24.5 |
| SUSE OpenStack Cloud 8 | openstack-neutron-doc | 11.0.9~dev51-3.24.4 |
| SUSE OpenStack Cloud 8 | openstack-neutron-gbp | 7.3.1~dev56-3.9.4 |
| SUSE OpenStack Cloud 8 | openstack-neutron-lbaas | 11.0.4~dev6-3.15.4 |
| SUSE OpenStack Cloud 8 | openstack-neutron-lbaas-doc | 11.0.4~dev6-3.15.4 |
| SUSE OpenStack Cloud 8 | openstack-nova | 16.1.9~dev7-3.29.3 |
| SUSE OpenStack Cloud 8 | openstack-nova-doc | 16.1.9~dev7-3.29.3 |
| SUSE OpenStack Cloud 8 | python-amqp | 2.2.2-3.6.3 |
| SUSE OpenStack Cloud 8 | python-ovs | 2.7.2-3.6.1 |
| SUSE OpenStack Cloud 8 | python-pysaml2 | 4.0.2-5.3.3 |
| SUSE OpenStack Cloud 8 | python-python-engineio | 2.0.2-3.3.3 |
| SUSE OpenStack Cloud 8 | python-urllib3 | 1.22-5.9.3 |
| SUSE OpenStack Cloud 8 | release-notes-suse-openstack-cloud | 8.20190911-3.20.3 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.1.1~dev7-12.20.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.21.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.18.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.2.3~dev16-14.21.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.19.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.16.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.3~dev3-12.19.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev13-12.21.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.4~dev6-14.26.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.8~dev7-12.21.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.4~dev4-11.22.3 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.20.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.1.1~dev2-12.23.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.18.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.16.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev2-12.16.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev51-13.24.3 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev7-11.22.3 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev2-12.21.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.4~dev1-11.20.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-swift | 2.15.2-11.13.3 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.1~dev13-11.20.2 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-core | 5.0+git.1569597589.1f025c557-3.32.2 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-ha | 5.0+git.1567673535.607aada-3.26.2 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-openstack | 5.0+git.1570141351.058c8bd44-4.31.2 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-ui | 1.2.0+git.1568396400.0344a727-3.12.3 |
| SUSE OpenStack Cloud Crowbar 8 | galera-3 | 25.3.25-4.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | grafana | 4.6.5-4.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | mariadb | 10.2.25-4.14.2 |
| SUSE OpenStack Cloud Crowbar 8 | mariadb-connector-c | 3.1.2-3.12.3 |
| SUSE OpenStack Cloud Crowbar 8 | novnc | 1.0.0-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder | 11.2.3~dev16-3.21.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder-doc | 11.2.3~dev16-3.21.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-glance | 15.0.3~dev3-3.12.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-glance-doc | 15.0.3~dev3-3.12.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat | 9.0.8~dev13-3.24.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-doc | 9.0.8~dev13-3.24.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-neutron-vpnaas-ui | 1.0.1~dev3-3.6.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-keystone | 12.0.4~dev4-5.27.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-keystone-doc | 12.0.4~dev4-5.27.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-installer | 20190923_16.32-3.9.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron | 11.0.9~dev51-3.24.5 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-doc | 11.0.9~dev51-3.24.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-gbp | 7.3.1~dev56-3.9.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-lbaas | 11.0.4~dev6-3.15.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-lbaas-doc | 11.0.4~dev6-3.15.4 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova | 16.1.9~dev7-3.29.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova-doc | 16.1.9~dev7-3.29.3 |
| SUSE OpenStack Cloud Crowbar 8 | python-amqp | 2.2.2-3.6.3 |
| SUSE OpenStack Cloud Crowbar 8 | python-ovs | 2.7.2-3.6.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-pysaml2 | 4.0.2-5.3.3 |
| SUSE OpenStack Cloud Crowbar 8 | python-urllib3 | 1.22-5.9.3 |
| SUSE OpenStack Cloud Crowbar 8 | release-notes-suse-openstack-cloud | 8.20190911-3.20.3 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-easy_diff | 1.0.0-3.4.2 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-nokogiri | 1.6.1-5.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-nokogiri | 1.6.1-5.3.1 |
| Ubuntu 16.04 LTS | ruby-nokogiri | 1.6.7.2-3ubuntu0.1 |
| Ubuntu 18.04 LTS | ruby-nokogiri | 1.8.2-1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | ruby-nokogiri | 1.6.1+ds-1ubuntu0.1~esm1 |
| openSUSE Leap 15.2 | rubygem-nokogiri | 1.8.5-lp152.4.3.1 |
| openSUSE Tumbleweed | ruby3.2-rubygem-nokogiri | 1.13.9-1.7 |
| openSUSE Tumbleweed | rubygem-nokogiri | 1.18.2-1.1 |
| openSUSE Tumbleweed | rubygem-nokogiri | 1.15.5-1.5 |
| openSUSE Tumbleweed | rubygem-nokogiri | 1.13.3-1.1 |
| openSUSE Tumbleweed | rubygem-nokogiri | 1.18.9-1.4 |