Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
@make_now_just 確認したところ CVE-2022-23514 https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh もありました。 https://hackerone.com/reports/1684163 で CVE-2022-23517 と同じ原因だったため一緒に採番されていたものです。 他は記載されているとおりです
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | loofah_project | loofah | - | ruby | - |