Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00eHFxLW0yaHgtMjV2OM4AA98F

REXML denial of service vulnerability

Impact

The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>.

If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

• https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability
• https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/

Permalink: https://github.com/advisories/GHSA-4xqq-m2hx-25v8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00eHFxLW0yaHgtMjV2OM4AA98F
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 5 months ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS Percentage: 0.00043
EPSS Percentile: 0.10511

Identifiers: GHSA-4xqq-m2hx-25v8, CVE-2024-39908
References:

• https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
• https://nvd.nist.gov/vuln/detail/CVE-2024-39908
• https://github.com/ruby/rexml/releases/tag/v3.3.2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-39908.yml
• https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908
• https://github.com/advisories/GHSA-4xqq-m2hx-25v8

Repository: https://github.com/ruby/rexml
Blast Radius: 23.3

Affected Packages