CVE-2019-5477 · cross-distro fix matrix

CVE-2019-5477: A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This

Affects 8 Linux releases across 11 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2019-5477 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

rexical→ fixed in1.0.7-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y rexical
```
ruby-nokogiri→ fixed in1.10.4+dfsg1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y ruby-nokogiri
```

Source: Debian Security Tracker

rexical→ fixed in1.0.7-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y rexical
```
ruby-nokogiri→ fixed in1.10.4+dfsg1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y ruby-nokogiri
```

Source: Debian Security Tracker

rexical→ fixed in1.0.7-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y rexical
```
ruby-nokogiri→ fixed in1.10.4+dfsg1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y ruby-nokogiri
```