Описание
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | ruby:3.3/ruby | Not affected | ||
| Red Hat Enterprise Linux 8 | ruby:2.5/ruby | Fix deferred | ||
| Red Hat Enterprise Linux 9 | pcs | Affected | ||
| Red Hat Enterprise Linux 9 | ruby:3.0/ruby | Affected | ||
| Red Hat OpenStack Platform 16.1 | puppet-datacat | Fix deferred | ||
| Red Hat OpenStack Platform 16.1 | puppet-etcd | Fix deferred | ||
| Red Hat OpenStack Platform 16.1 | puppet-opendaylight | Out of support scope | ||
| Red Hat OpenStack Platform 16.2 | puppet-datacat | Not affected | ||
| Red Hat OpenStack Platform 16.2 | puppet-etcd | Not affected | ||
| Red Hat OpenStack Platform 16.2 | puppet-opendaylight | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
3.3 Low
CVSS3
Связанные уязвимости
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulner ...
EPSS
3.3 Low
CVSS3