{"id":"CVE-2024-58377","aliases":["EUVD-2024-55731","GHSA-r95h-9x8f-r3f7","GHSA-rpqg-75pv-92c9","UBUNTU-CVE-2024-58377"],"status":"rejected","title":"Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459","description":"This CVE ID has been rejected as a duplicate.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-125","CWE-427"],"published":"2024-05-13T16:05:42Z","modified":"2026-10-27T23:10:00Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.16.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"]}],"references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7","tags":["advisory","web","report"]},{"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5","tags":["web"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53","tags":["web"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/720","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r95h-9x8f-r3f7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58377","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/commit/2876ac53"},{"url":"https://www.vulncheck.com/advisories/nokogiri-before-libxml2-dependency-update","tags":["advisory","report"]},{"url":"https://github.com/GNOME/libxml2/commit/2876ac53","tags":["fix","report"]},{"url":"https://github.com/advisories/GHSA-rpqg-75pv-92c9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58377.json","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-58377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-58377","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-58377","description":"This CVE ID has been rejected as a duplicate.","status":"rejected","published":"2026-08-25T15:15:56.569Z","modified":"2026-09-01T20:33:42.399Z","updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-55731","description":"This CVE ID has been rejected as a duplicate.","status":"published","published":"2026-08-25T15:15:56Z","modified":"2026-09-01T20:33:42Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:16.444637Z"}],"ghsa":[{"id":"GHSA-rpqg-75pv-92c9","title":"Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in...","description":"Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.","status":"published","published":"2026-08-25T18:31:49Z","modified":"2026-08-28T21:30:51Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-125","CWE-427"],"updated_at":"2026-11-02T15:11:08.095363Z"},{"id":"GHSA-r95h-9x8f-r3f7","title":"Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459","description":"## Summary\n\nNokogiri v1.16.5 upgrades its dependency libxml2 to [2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.\n\nlibxml2 v2.12.7 addresses CVE-2024-34459:\n\n- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720\n- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53\n\n\n## Impact\n\nThere is no impact to Nokogiri users because the issue is present only in libxml2's `xmllint` tool which Nokogiri does not provide or expose.\n\n\n## Timeline\n\n- 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced\n- 2024-05-13 08:30 EDT, nokogiri maintainers begin triage\n- 2024-05-13 10:05 EDT, nokogiri [v1.16.5 is released](https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5) and this GHSA made public","status":"published","published":"2024-05-13T16:05:42Z","modified":"2025-09-22T19:16:20Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2024-58377","description":"Rejected reason: This CVE ID has been rejected as a duplicate.","status":"rejected","published":"2026-08-25T16:16:45.003Z","modified":"2026-10-27T23:10:00.153Z","updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"CVE-2024-58377","title":"Nokogiri before 1.16.5 libxml2 Dependency Update","description":"Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.","status":"published","published":"2026-08-25T15:15:56.569Z","modified":"2026-08-30T03:45:31.109278319Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"UBUNTU-CVE-2024-58377","description":"Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.","status":"withdrawn","published":"2026-08-25T16:16:00Z","modified":"2026-09-16T14:01:16.225870732Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"GHSA-r95h-9x8f-r3f7","title":"Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459","description":"## Summary\n\nNokogiri v1.16.5 upgrades its dependency libxml2 to [2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6.\n\nlibxml2 v2.12.7 addresses CVE-2024-34459:\n\n- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720\n- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53\n\n\n## Impact\n\nThere is no impact to Nokogiri users because the issue is present only in libxml2's `xmllint` tool which Nokogiri does not provide or expose.\n\n\n## Timeline\n\n- 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced\n- 2024-05-13 08:30 EDT, nokogiri maintainers begin triage\n- 2024-05-13 10:05 EDT, nokogiri [v1.16.5 is released](https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5) and this GHSA made public","status":"published","published":"2024-05-13T16:05:42Z","modified":"2026-08-27T04:10:44.486576234Z","cwes":["CWE-120"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}