6.5med
CVE-2017-18258
Uncontrolled resource consumption in nokogiri
Also known as GHSA-882p-jqgm-f45g
Published 8 y ago · modified 24 d ago · JSON
CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.7%
percentile 86%
Public exploits
0
none known
Summary
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Exploit prediction (EPSS)
2.73% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| GitHub | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | nokogiri | <1.8.2 | 1.8.2 |
Affected products
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- lists.debian.org /debian-lts-announce/2018/09/msg00035.html · mailing-list, x_refsource_MLIST, x_transferred
- usn.ubuntu.com /3739-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
- git.gnome.org /browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb · x_refsource_MISC, x_transferred
- kc.mcafee.com /corporate/index?page=content&id=SB10284 · x_refsource_CONFIRM, x_transferred
- security.netapp.com /advisory/ntap-20190719-0001/ · x_refsource_CONFIRM, x_transferred
- lists.debian.org /debian-lts-announce/2020/09/msg00009.html · mailing-list, x_refsource_MLIST, x_transferred
- cert-portal.siemens.com /productcert/html/ssa-398330.html
- nvd.nist.gov /vuln/detail/CVE-2017-18258 · advisory
- github.com /advisories/GHSA-882p-jqgm-f45g · advisory
- github.com /rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml · web
- security.netapp.com /advisory/ntap-20190719-0001 · web
- usn.ubuntu.com /3739-1 · web
Sources
- CVE List: CVE-2017-18258
- GitHub Advisory: GHSA-882p-jqgm-f45g
- NVD: CVE-2017-18258
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.