CVE-2024-58377: Nokogiri < 1.16.5 includes vulnerable libxml2 library

Versions of the Nokogiri Ruby library released before 1.16.5 contain an older copy of the libxml2 component that has a known weakness in its xmllint utility. The weakness matters only if that utility is made available, which Nokogiri does not expose, so ordinary users are not directly at risk. Updating Nokogiri to version 1.16.5 or later replaces the component with a safe version.

• https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-...
• https://github.com/advisories/GHSA-r95h-9x8f-r3f7
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58377... Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58377 Vendor Advisory
• https://www.vulncheck.com/advisories/nokogiri-before-libxml2-dependency-update Third Party Advisory
• https://github.com/GNOME/libxml2/commit/2876ac53 Third Party Advisory
• https://github.com/sparklemotion/nokogiri/commit/2876ac53 Patch
• https://ubuntu.com/security/CVE-2024-58377 Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2024-58377 Third Party Advisory
• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f... Third Party Advisory