-------------------------------------------------------------------------
Debian LTS Advisory DLA-3868-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Sean Whitton
September 03, 2024                            https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : ruby-nokogiri
Version        : 1.11.1+dfsg-2+deb11u1
CVE ID         : CVE-2022-24836
Debian Bug     : 1009787

A vulnerability was discovered in Nokogiri, an open source XML and HTML
library for Ruby.  An inefficient regular expression was susceptible to
excessive backtracking when attempting to detect encoding in HTML
documents.  This could lead to denial-of-service.

For Debian 11 bullseye, this problem has been fixed in version
1.11.1+dfsg-2+deb11u1.

We recommend that you upgrade your ruby-nokogiri packages.

For the detailed security status of ruby-nokogiri please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-nokogiri

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS