DoS vulnerabilities in REXML
Published: August 01, 2024
SECURITY IDENTIFIERS
- CVE: CVE-2024-41946 (NVD)
- GHSA: GHSA-5866-49gr-22v4
- Vendor Advisory: https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946
GEM
SEVERITY
CVSS v3.x: 5.3 (Medium)
PATCHED VERSIONS
>= 3.3.3
DESCRIPTION
There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-41946. We strongly recommend upgrading the REXML gem.
Details
When parsing an XML that has many entity expansions with SAX2 or pull parser API, REXML gem may take long time.
Please update REXML gem to version 3.3.3 or later.
Affected versions
- REXML gem 3.3.2 or prior
Credits
Thanks to NAITOH Jun for discovering and fixing this issue.
History
Originally published at 2024-08-01 03:00:00 (UTC)