[prev in list] [next in list] [prev in thread] [next in thread]
List: ruby-talk
Subject: Nokogiri security update v1.11.4
From: Mike Dalessio <mike.dalessio () gmail ! com>
Date: 2021-05-14 23:37:39
Message-ID: CAGJbjKY4bPw1XE5iaUkSh1j2yzmi82YmJP_wBq8+=Atr2EPAZA () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Nokogiri v1.11.4 was released on 2021-05-14, which contains an updated
version of libxml2 that addresses several upstream CVEs.
These CVEs are fully described at
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64.
That security advisory is reproduced here for your convenience.
---
Summary
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which
addresses:
- CVE-2019-20388 <https://security.archlinux.org/CVE-2019-20388> (Medium
severity)
- CVE-2020-24977 <https://security.archlinux.org/CVE-2020-24977> (Medium
severity)
- CVE-2021-3517 <https://security.archlinux.org/CVE-2021-3517> (Medium
severity)
- CVE-2021-3518 <https://security.archlinux.org/CVE-2021-3518> (Medium
severity)
- CVE-2021-3537 <https://security.archlinux.org/CVE-2021-3537> (Low
severity)
- CVE-2021-3541 <https://security.archlinux.org/CVE-2021-3541> (Low
severity)
Note that two additional CVEs were addressed upstream but are not relevant
to this release. CVE-2021-3516
<https://security.archlinux.org/CVE-2021-3516> via xmllint is not present
in Nokogiri, and CVE-2020-7595
<https://security.archlinux.org/CVE-2020-7595> has been patched in Nokogiri
since v1.10.8 (see #1992
<https://github.com/sparklemotion/nokogiri/issues/1992>).
Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being
used. If you've overridden defaults at installation time to use system
libraries instead of packaged libraries, you should instead pay attention
to your distro's libxml2 release announcements.
Mitigation
Upgrade to Nokogiri >= 1.11.4.
Impact
I've done a brief analysis of the published CVEs that are addressed in this
upstream release. The libxml2 maintainers have not released a canonical set
of CVEs, and so this list is pieced together from secondary sources and may
be incomplete.
All information below is sourced from security.archlinux.org, which appears
to have the most up-to-date information as of this analysis.
CVE-2019-20388 <https://security.archlinux.org/CVE-2019-20388>
- Severity: Medium
- Type: Denial of service
- Description: A memory leak was found in the xmlSchemaValidateStream
function of libxml2. Applications that use this library may be vulnerable
to memory not being freed leading to a denial of service.
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2020-7595 <https://security.archlinux.org/CVE-2020-7595>
- Severity: Medium
- Type: Denial of service
- Description: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10
has an infinite loop in a certain end-of-file situation.
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
This has been patched in Nokogiri since v1.10.8 (see #1992
<https://github.com/sparklemotion/nokogiri/issues/1992>).
CVE-2020-24977 <https://security.archlinux.org/CVE-2020-24977>
- Severity: Medium
- Type: Information disclosure
- Description: GNOME project libxml2 <= 2.9.10 has a global buffer
over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3516 <https://security.archlinux.org/CVE-2021-3516>
- Severity: Medium
- Type: Arbitrary code execution (no remote vector)
- Description: A use-after-free security issue was found libxml2 before
version 2.9.11 when "xmllint --html --push" is used to process crafted
files.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Verified that the fix commit first appears in v2.9.11. This vector does not
exist within Nokogiri, which does not ship xmllint.
CVE-2021-3517 <https://security.archlinux.org/CVE-2021-3517>
- Severity: Medium
- Type: Arbitrary code execution
- Description: A heap-based buffer overflow was found in libxml2 before
version 2.9.11 when processing truncated UTF-8 input.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/235
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2
Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3518 <https://security.archlinux.org/CVE-2021-3518>
- Severity: Medium
- Type: Arbitrary code execution
- Description: A use-after-free security issue was found in libxml2
before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when
processing crafted files.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7
Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3537 <https://security.archlinux.org/CVE-2021-3537>
- Severity: Low
- Type: Denial of service
- Description: It was found that libxml2 before version 2.9.11 did not
propagate errors while parsing XML mixed content, causing a NULL
dereference. If an untrusted XML document was parsed in recovery mode and
post-validated, the flaw could be used to crash the application.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/243
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61
Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3541 <https://security.archlinux.org/CVE-2021-3541>
- Severity: Low
- Type: Denial of service
- Description: A security issue was found in libxml2 before version
2.9.11. Exponential entity expansion attack its possible bypassing all
existing protection mechanisms and leading to denial of service.
- Fixed:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
Verified that the fix commit first appears in v2.9.11. It seems possible
that this issue would be present in programs using Nokogiri < v1.11.4,
however Nokogiri's default parse options prevent the attack from succeeding
(it is necessary to opt into DTDLOAD which is off by default).
[Attachment #5 (text/html)]
<div dir="ltr">Nokogiri v1.11.4 was released on 2021-05-14, which contains an updated \
version of libxml2 that addresses several upstream CVEs.<div><br></div><div>These \
CVEs are fully described at <a \
href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp6 \
4">https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64</a>. \
That security advisory is reproduced here for your \
convenience.</div><div><br></div><div>---</div><div><br></div><div><h3 \
style="box-sizing:border-box;margin-bottom:16px;font-size:1.25em;line-height:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";margin-top:0px">Summary</h3><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Nokogiri v1.11.4 updates the vendored libxml2 from \
v2.9.10 to v2.9.12 which addresses:</p><ul \
style="box-sizing:border-box;padding-left:2em;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px"><li \
style="padding-bottom:0.6001em;box-sizing:border-box"><a \
href="https://security.archlinux.org/CVE-2019-20388" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2019-20388</a> \
(Medium severity)</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><a \
href="https://security.archlinux.org/CVE-2020-24977" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2020-24977</a> \
(Medium severity)</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><a \
href="https://security.archlinux.org/CVE-2021-3517" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2021-3517</a> \
(Medium severity)</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><a \
href="https://security.archlinux.org/CVE-2021-3518" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2021-3518</a> \
(Medium severity)</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><a \
href="https://security.archlinux.org/CVE-2021-3537" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2021-3537</a> \
(Low severity)</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><a \
href="https://security.archlinux.org/CVE-2021-3541" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2021-3541</a> \
(Low severity)</li></ul><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Note that two additional CVEs were addressed upstream but \
are not relevant to this release. <a \
href="https://security.archlinux.org/CVE-2021-3516" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2021-3516</a> \
via <code style="box-sizing:border-box;font-family:SFMono-Regular,Consolas,"Liberation \
Mono",Menlo,monospace;font-size:11.9px;padding:0.2em \
0.4em;margin:0px;border-radius:6px">xmllint</code> is not present in Nokogiri, and \
<a href="https://security.archlinux.org/CVE-2020-7595" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2020-7595</a> \
has been patched in Nokogiri since v1.10.8 (see <a class="gmail-issue-link \
gmail-js-issue-link" href="https://github.com/sparklemotion/nokogiri/issues/1992" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">#1992</a>).</p><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Please note that this advisory only applies to the CRuby \
implementation of Nokogiri <code \
style="box-sizing:border-box;font-family:SFMono-Regular,Consolas,"Liberation \
Mono",Menlo,monospace;font-size:11.9px;padding:0.2em \
0.4em;margin:0px;border-radius:6px">< 1.11.4</code>, and only if the packaged \
version of libxml2 is being used. If you've overridden defaults at installation \
time to use system libraries instead of packaged libraries, you should instead pay \
attention to your distro's <code \
style="box-sizing:border-box;font-family:SFMono-Regular,Consolas,"Liberation \
Mono",Menlo,monospace;font-size:11.9px;padding:0.2em \
0.4em;margin:0px;border-radius:6px">libxml2</code> release announcements.</p><h3 \
style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;font-size:1.25em;line- \
height:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji"">Mitigation</h3><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Upgrade to Nokogiri <code \
style="box-sizing:border-box;font-family:SFMono-Regular,Consolas,"Liberation \
Mono",Menlo,monospace;font-size:11.9px;padding:0.2em \
0.4em;margin:0px;border-radius:6px">>= 1.11.4</code>.</p><h3 \
style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;font-size:1.25em;line- \
height:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji"">Impact</h3><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">I've done a brief analysis of the published CVEs that \
are addressed in this upstream release. The libxml2 maintainers have not released a \
canonical set of CVEs, and so this list is pieced together from secondary sources and \
may be incomplete.</p><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">All information below is sourced from <a \
href="https://security.archlinux.org/" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">security.archlinux.org</a>, \
which appears to have the most up-to-date information as of this analysis.</p><h4 \
style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;font-size:14px;line-he \
ight:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji""><a href="https://security.archlinux.org/CVE-2019-20388" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2019-20388</a></h4><ul \
style="box-sizing:border-box;padding-left:2em;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px"><li \
style="padding-bottom:0.6001em;box-sizing:border-box"><span \
style="box-sizing:border-box;font-weight:600">Severity</span>: Medium</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Type</span>: Denial of service</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Description</span>: A memory leak was \
found in the xmlSchemaValidateStream function of libxml2. Applications that use this \
library may be vulnerable to memory not being freed leading to a denial of \
service.</li><li style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Fixed</span>: <a \
href="https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a" \
rel="nofollow" style="box-sizing:border-box;background-color:initial;text-decoration-l \
ine:none">https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a</a></li></ul><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Verified that the fix commit first appears in v2.9.11. It \
seems possible that this issue would be present in programs using Nokogiri < \
v1.11.4.</p><h4 style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;font-s \
ize:14px;line-height:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji""><a href="https://security.archlinux.org/CVE-2020-7595" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2020-7595</a></h4><ul \
style="box-sizing:border-box;padding-left:2em;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px"><li \
style="padding-bottom:0.6001em;box-sizing:border-box"><span \
style="box-sizing:border-box;font-weight:600">Severity</span>: Medium</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Type</span>: Denial of service</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Description</span>: \
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a \
certain end-of-file situation.</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Fixed</span>: <a \
href="https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5" \
rel="nofollow" style="box-sizing:border-box;background-color:initial;text-decoration-l \
ine:none">https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5</a></li></ul><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">This has been patched in Nokogiri since v1.10.8 (see <a \
class="gmail-issue-link gmail-js-issue-link" \
href="https://github.com/sparklemotion/nokogiri/issues/1992" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">#1992</a>).</p><h4 \
style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;font-size:14px;line-he \
ight:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji""><a href="https://security.archlinux.org/CVE-2020-24977" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2020-24977</a></h4><ul \
style="box-sizing:border-box;padding-left:2em;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px"><li \
style="padding-bottom:0.6001em;box-sizing:border-box"><span \
style="box-sizing:border-box;font-weight:600">Severity</span>: Medium</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Type</span>: Information \
disclosure</li><li style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Description</span>: GNOME project \
libxml2 <= 2.9.10 has a global buffer over-read vulnerability in \
xmlEncodeEntitiesInternal at libxml2/entities.c.</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Fixed</span>: <a \
href="https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2" \
rel="nofollow" style="box-sizing:border-box;background-color:initial;text-decoration-l \
ine:none">https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2</a></li></ul><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Verified that the fix commit first appears in v2.9.11. It \
seems possible that this issue would be present in programs using Nokogiri < \
v1.11.4.</p><h4 style="box-sizing:border-box;margin-top:24px;margin-bottom:16px;font-s \
ize:14px;line-height:1.25;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji""><a href="https://security.archlinux.org/CVE-2021-3516" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">CVE-2021-3516</a></h4><ul \
style="box-sizing:border-box;padding-left:2em;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px"><li \
style="padding-bottom:0.6001em;box-sizing:border-box"><span \
style="box-sizing:border-box;font-weight:600">Severity</span>: Medium</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Type</span>: Arbitrary code execution \
(no remote vector)</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Description</span>: A use-after-free \
security issue was found libxml2 before version 2.9.11 when "xmllint --html \
--push" is used to process crafted files.</li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Issue</span>: <a \
href="https://gitlab.gnome.org/GNOME/libxml2/-/issues/230" rel="nofollow" \
style="box-sizing:border-box;background-color:initial;text-decoration-line:none">https://gitlab.gnome.org/GNOME/libxml2/-/issues/230</a></li><li \
style="padding-bottom:0.6001em;box-sizing:border-box;margin-top:0.25em"><span \
style="box-sizing:border-box;font-weight:600">Fixed</span>: <a \
href="https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539" \
rel="nofollow" style="box-sizing:border-box;background-color:initial;text-decoration-l \
ine:none">https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539</a></li></ul><p \
style="box-sizing:border-box;margin-top:0px;margin-bottom:16px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe \
UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI \
Emoji";font-size:14px">Verified that the fix commit first appears in v2.9.11. \
This vector does not exist within Nokogiri, which does not ship <code \
style="box-sizing:border-box;font-family:SFMono-Regular,Consolas,"Liberation \
Unsubscribe: <mailto:ruby-talk-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic