kritik
CVE-2019-11068
libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Julia, Photon OS, Ruby Advisory DB. Daha düşük diyenler: Red Hat (orta), Amazon (orta), Oracle (orta), Ubuntu (orta).
Açıklama
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | XSLT_jll | 1.1.34+0 |
| Photon OS 1.0 | libxslt | 1.1.29-5.ph1 |
| Photon OS 2.0 | libxslt | 1.1.29-5.ph2 |
| Photon OS 3.0 | libxslt | 1.1.32-2.ph3 |
| rubygems::GitHub Security Advisory RubyGems | nokogiri | 1.10.3 |
| rubygems::Ruby Advisory Database | nokogiri | >= 1.10.3 |
| alpine 3.10 | libxslt | 1.1.33-r1 |
| alpine 3.11 | libxslt | 1.1.33-r1 |
| alpine 3.12 | libxslt | 1.1.33-r1 |
| alpine 3.13 | libxslt | 1.1.33-r1 |
| alpine 3.14 | libxslt | 1.1.33-r1 |
| alpine 3.15 | libxslt | 1.1.33-r1 |
50 kaynaktaki 63 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | XSLT_jll | 1.1.34+0 |
| Photon OS 1.0 | libxslt | 1.1.29-5.ph1 |
| Photon OS 2.0 | libxslt | 1.1.29-5.ph2 |
| Photon OS 3.0 | libxslt | 1.1.32-2.ph3 |
| rubygems::GitHub Security Advisory RubyGems | nokogiri | 1.10.3 |
| rubygems::Ruby Advisory Database | nokogiri | >= 1.10.3 |
| alpine 3.10 | libxslt | 1.1.33-r1 |
| alpine 3.11 | libxslt | 1.1.33-r1 |
| alpine 3.12 | libxslt | 1.1.33-r1 |
| alpine 3.13 | libxslt | 1.1.33-r1 |
| alpine 3.14 | libxslt | 1.1.33-r1 |
| alpine 3.15 | libxslt | 1.1.33-r1 |
| alpine 3.16 | libxslt | 1.1.33-r1 |
| alpine 3.17 | libxslt | 1.1.33-r1 |
| alpine 3.18 | libxslt | 1.1.33-r1 |
| alpine 3.19 | libxslt | 1.1.33-r1 |
| alpine 3.20 | libxslt | 1.1.33-r1 |
| alpine 3.21 | libxslt | 1.1.33-r1 |
| alpine 3.22 | libxslt | 1.1.33-r1 |
| alpine 3.23 | libxslt | 1.1.33-r1 |
| alpine 3.24 | libxslt | 1.1.33-r1 |
| alpine 3.6 | libxslt | 1.1.29-r4 |
| alpine 3.7 | libxslt | 1.1.31-r1 |
| alpine 3.8 | libxslt | 1.1.33-r1 |
| alpine 3.9 | libxslt | 1.1.33-r1 |
| alpine edge | libxslt | 1.1.33-r1 |
| amazon linux 1 | libxslt | 1.1.28-6.15.amzn1 |
| amazon linux 1 | libxslt-debuginfo | 1.1.28-6.15.amzn1 |
| amazon linux 1 | libxslt-devel | 1.1.28-6.15.amzn1 |
| amazon linux 1 | libxslt-python26 | 1.1.28-6.15.amzn1 |
| amazon linux 1 | libxslt-python27 | 1.1.28-6.15.amzn1 |
| amazon linux 2 | libxslt | 1.1.28-6.amzn2 |
| amazon linux 2 | libxslt-debuginfo | 1.1.28-6.amzn2 |
| amazon linux 2 | libxslt-devel | 1.1.28-6.amzn2 |
| amazon linux 2 | libxslt-python | 1.1.28-6.amzn2 |
| debian 10 | libxslt | 1.1.32-2.1~deb10u1 |
| debian 11 | libxslt | 1.1.32-2.1 |
| debian 12 | libxslt | 1.1.32-2.1 |
| debian 13 | libxslt | 1.1.32-2.1 |
| debian 14 | libxslt | 1.1.32-2.1 |
| debian 8 | libxslt | 1.1.28-2+deb8u4 |
| debian 9 | libxslt | 1.1.29-2.1+deb9u1 |
| echo | libxslt | 1.1.32-2.1 |
| Oracle Linux 7 | libxslt | 1.1.28-6.0.1.el7 |
| Oracle Linux 7 | libxslt-devel | 1.1.28-6.0.1.el7 |
| Oracle Linux 7 | libxslt-python | 1.1.28-6.0.1.el7 |
| Oracle Linux 8 | libxslt | 1.1.32-5.0.1.el8 |
| Oracle Linux 8 | libxslt-devel | 1.1.32-5.0.1.el8 |
| Red Hat | libxslt | düzeltme belirtilmemiş |
| Red Hat | libxslt-devel | düzeltme belirtilmemiş |
| Red Hat | libxslt-python | düzeltme belirtilmemiş |
| root.io debian 11 | rootio-libxslt | 1.1.32-2.1 |
| root.io debian 12 | rootio-libxslt | 1.1.32-2.1 |
| root.io debian 13 | rootio-libxslt | 1.1.32-2.1 |
| seal Red Hat 7 | libxslt | 1.1.28-6.0.1.el7+sp999, 1.1.28-6.el7+sp999 |
| seal Red Hat 7 | seal-libxslt | 1.1.28-6.0.1.el7+sp999, 1.1.28-6.el7+sp999 |
| ubuntu 14.04 | libxslt | 1.1.28-2ubuntu0.2 |
| ubuntu 14.04-ESM | libxslt | 1.1.28-2ubuntu0.2 |
| ubuntu 16.04 | libxslt | 1.1.28-2.1ubuntu0.2 |
| ubuntu 16.04-ESM | libxslt | 1.1.28-2.1ubuntu0.2 |
| ubuntu 18.04 | libxslt | 1.1.29-5ubuntu0.1 |
| ubuntu 18.04-ESM | libxslt | 1.1.29-5ubuntu0.1 |
| ubuntu 18.10 | libxslt | 1.1.32-2ubuntu0.1 |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
- http://www.openwall.com/lists/oss-security/2019/04/22/1
- http://www.openwall.com/lists/oss-security/2019/04/23/5
- https://access.redhat.com/security/cve/CVE-2019-11068
35 referansın hepsi
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml
- https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826
- https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9
- https://github.com/sparklemotion/nokogiri/issues/1892
- https://github.com/sparklemotion/nokogiri/pull/1898
- https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
- https://groups.google.com/forum/#!msg/ruby-security-ann/_y80o1zZlOs/k4SDX6hoAAAJ
- https://linux.oracle.com/cve/CVE-2019-11068.html
- https://linux.oracle.com/errata/ELSA-2020-4464.html
- https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11068
- https://security.netapp.com/advisory/ntap-20191017-0001
- https://security.netapp.com/advisory/ntap-20191017-0001/
- https://ubuntu.com/security/notices/USN-3947-1
- https://ubuntu.com/security/notices/USN-3947-2
- https://usn.ubuntu.com/3947-1
- https://usn.ubuntu.com/3947-1/
- https://usn.ubuntu.com/3947-2
- https://usn.ubuntu.com/3947-2/
- https://www.cve.org/CVERecord?id=CVE-2019-11068
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html