Nokogiri subject to DoS via libxml2 vulnerability

[sniffler-app]

Description

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.

Informations

Manifest Path: Gemfile.lock

Please look at dependabot report :https://github.com/swipely/reinvent-demo/security/dependabot/26