org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
References
Link | Resource |
---|---|
https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d | Patch |
https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv | Vendor Advisory |
https://www.oracle.com/security-alerts/cpujul2022.html | Patch Third Party Advisory |
Configurations
History
23 Feb 2023, 20:19
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* |
|
First Time |
Oracle weblogic Server
Oracle |
|
References | (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory | |
References | (CONFIRM) https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv - Vendor Advisory |
25 Jul 2022, 18:22
Type | Values Removed | Values Added |
---|---|---|
References |
|
19 Apr 2022, 15:45
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
First Time |
Nekohtml Project nekohtml
Nekohtml Project |
|
CPE | cpe:2.3:a:nekohtml_project:nekohtml:*:*:*:*:*:nokogiri:*:* | |
References | (MISC) https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d - Patch, Third Party Advisory | |
References | (CONFIRM) https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv - Third Party Advisory |
11 Apr 2022, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-04-11 22:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-24839
Mitre link : CVE-2022-24839
CVE.ORG link : CVE-2022-24839
JSON object : View
Products Affected
oracle
- weblogic_server
nekohtml_project
- nekohtml
CWE
CWE-400
Uncontrolled Resource Consumption