Bug 2523569 (CVE-2023-54354)

Summary:	CVE-2023-54354 nokogiri: libxml2: Nokogiri: Denial of Service via crafted XML schema
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akostadi, amasferr, anthomas, crizzo, dmayorov, ehelms, eshamard, ggainey, jlledo, jpasqual, juwatts, jvasik, kaycoth, mdellweg, mhulan, nmoumoul, osousa, pantinor, pcreech, rblanco, rchan, rhel-process-autobot, smallamp, tmalecek, tsedmik, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Nokogiri, specifically in its bundled libxml2 library when processing XML schemas. An attacker can exploit this by providing a specially crafted XML schema, leading to a NULL pointer dereference. This can cause the application to crash, resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-25 15:35:06 UTC

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.

Comment 1 Yadnyawalk Tale 2026-08-31 07:32:00 UTC

* Lowering CVSS score justification *

- Trigger requires processing attacker-supplied XML Schema (XSD) via Nokogiri::XML::Schema - a code path rarely exposed in 3scale, Satellite, OCM acceptance tests or RHEL admin tooling, which primarily parse HTML/XML documents.
- Impact is already DoS-only (NULL pointer dereference → crash); no C/I.
- AC:H is warranted because exploitation depends on the application exposing schema validation to untrusted input - not default Nokogiri usage.
- RHEL rubygem-nokogiri RPM builds with NOKOGIRI_USE_SYSTEM_LIBRARIES=yes (system libxml2, not bundled), further limiting exposure for RPM-based deployments.