~ / search / GHSA-4xqq-m2hx-25v8

GHSA-4xqq-m2hx-25v8

REXML denial of service vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-39908

Packages

EcosystemPackageAffectedFixed in
RubyGems rexml < 3.3.2 3.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. ### Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. ### Workarounds Don't parse untrusted XMLs. ### References * https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability * https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/

References

External links from the advisory. They lead to third-party sites.