libxslt through 1.1.33 allows bypass of a protection mechanism because callers of…
Priority MEDIUM 50Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 10 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05187 92nd percentileScored 2026-11-07
Fix Partial nokogiri (RubyGems): 1.10.3Red Hat: 2 advisoriesRed Hat: 10 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | before 1.10.3 | 1.10.3 | Patch available | GHSA-qxcg-xjjg-66mj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected before 1.10.3 Fixed in 1.10.3 Patch available GHSA-qxcg-xjjg-66mj
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:* | up to 1.1.33 | Vulnerable | xmlsoft |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:jdk:8.0:update_221:*:*:*:*:*:* | 8.0 update_221 | Vulnerable | Oracle |
- cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:* Versions up to 1.1.33 Vulnerable ·xmlsoft
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:jdk:8.0:update_221:*:*:*:*:*:* Versions 8.0 update_221 Vulnerable ·Oracle
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.70.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* | 42.3 | Vulnerable | openSUSE |
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.70.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
Remediation
- Fix · GHSA-qxcg-xjjg-66mj nokogiri (RubyGems) Fixed in 1.10.3 Advisory →
Red Hat 2 advisories
- RHSA-2020:4464 Released 2020-11-04 · Red Hat rating Moderatelibxslt security update
- Red Hat Enterprise Linux AppStream (v. 8) libxslt-devel-1.1.32-5.el8
- Red Hat Enterprise Linux BaseOS (v. 8) libxslt-1.1.32-5.el8
- RHSA-2020:4005 Released 2020-09-29 · Red Hat rating Moderatelibxslt security update
- Red Hat Enterprise Linux Client (v. 7) libxslt-1.1.28-6.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libxslt-devel-1.1.28-6.el7, libxslt-python-1.1.28-6.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) libxslt-1.1.28-6.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libxslt-devel-1.1.28-6.el7, libxslt-python-1.1.28-6.el7
- Red Hat Enterprise Linux Server (v. 7) libxslt-1.1.28-6.el7, libxslt-1.1.28-6.el7.ppc, libxslt-devel-1.1.28-6.el7 +1
- Red Hat Enterprise Linux Server Optional (v. 7) libxslt-python-1.1.28-6.el7
- Red Hat Enterprise Linux Workstation (v. 7) libxslt-1.1.28-6.el7, libxslt-devel-1.1.28-6.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) libxslt-python-1.1.28-6.el7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4464 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:4464 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:4005 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11068
- 2026-10-03 Alias added: GHSA-qxcg-xjjg-66mj
References
Patch 2
Advisory 15
- [debian-lts-announce] 20190415 [SECURITY] [DLA 1756-1] libxslt security update
- USN-3947-2
- [oss-security] 20190422 Nokogiri security update v1.10.3
- USN-3947-1
- [oss-security] 20190423 Re: Nokogiri security update v1.10.3
- openSUSE-SU-2019:1433
- openSUSE-SU-2019:1430
- openSUSE-SU-2019:1428
- openSUSE-SU-2019:1527
- FEDORA-2019-e21c77ffae
- FEDORA-2019-320d5295fc
- FEDORA-2019-e74d639587
- openSUSE-SU-2019:1824
- https://security.netapp.com/advisory/ntap-20191017-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11068
Other 14
- https://github.com/sparklemotion/nokogiri/issues/1892
- https://github.com/sparklemotion/nokogiri/pull/1898
- https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9
- https://usn.ubuntu.com/3947-2
- https://usn.ubuntu.com/3947-1
- https://security.netapp.com/advisory/ntap-20191017-0001
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K
- https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml
Sources
- CVE-2019-11068 · CVE Program
- CVE-2019-11068 · NVD
- FIRST EPSS
- GHSA-qxcg-xjjg-66mj · GitHub Advisory Database · CC BY 4.0
- CVE-2019-11068 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences