GHSA-8cr8-4vfw-mr7h

REXML round-trip instability

Source: GitHub Advisory Database (reviewed) High CVE-2021-28965

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	rexml	< 3.2.5	3.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-28965 advisory
https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b web
https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377 web
https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752 web
https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e web
https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8 web
https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551 web
https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618 web
https://hackerone.com/reports/1104077 web
https://github.com/ruby/rexml package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml web
https://lists.fedoraproject.org/archives/list/[email protected]/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT web
https://rubygems.org/gems/rexml web
https://security.netapp.com/advisory/ntap-20210528-0003 web
https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965 web