Описание
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| ruby3.3 | fixed | 3.3.5-1 | package | |
| ruby3.2 | removed | package | ||
| ruby3.1 | removed | package | ||
| ruby3.1 | no-dsa | bookworm | package | |
| ruby2.7 | removed | package |
Примечания
https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/
https://github.com/ruby/rexml/issues/232#issuecomment-2585211411
Fixed by commit [1/2] https://github.com/ruby/rexml/commit/6cac15d45864c8d70904baa5cbfcc97181000960 (v3.3.3)
Fixed by commit [2/2] https://github.com/ruby/rexml/commit/e2546e6ecade16b04c9ee528e5be8509fe16c2d6 (v3.3.3)
EPSS
Связанные уязвимости
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Уязвимость набора инструментов XML для Ruby REXML, связанная с неконтролируемым потреблением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS