Description

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

Related CPE's

a

ruby-lang

rexml

*

*

*

*

*

ruby

Vulnerable

References

https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368

Patch

https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4

Vendor Advisory

https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml

Not Applicable

https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-400

[email protected]

Secondary
CWE-400

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-08-01T15:15:14.100

3 months ago

Last modified

2024-09-05T16:09:45.503

1 month ago