A ruby-nokogiri security update has been released for Debian GNU/Linux 8 Extended LTS to address a potential denial of service attack.
ELA-609-1 ruby-nokogiri security update
Package ruby-nokogiri
ELA-609-1 ruby-nokogiri security update
Version 1.6.3.1+ds-1+deb8u3
Related CVEs CVE-2022-24836
It was discovered that there was a potential denial of service attack in ruby-nokogiri, a HTML, XML, SAX etc. parser written in/for the Ruby programming language. This was caused by the use of inefficient regular expressions that were susceptible to excessive backtracking.
For Debian 8 Jessie, these problems have been fixed in version 1.6.3.1+ds-1+deb8u3.
We recommend that you upgrade your ruby-nokogiri packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/
