CVE-2021-28965

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

References

Affected packages

Git / github.com/ruby/rexml

Affected ranges

Type

GIT

Repo

https://github.com/ruby/rexml

Events

Introduced

Fixed

a622645e980ea5b91ad7b4d6fec32d113f15df88

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.5"
        }
    ]
}

Type

GIT

Repo

https://github.com/ruby/ruby

Events

Introduced

Fixed

930143880a8b593e7444b94e2e0522b83a25c671

Introduced

647ee6f091eafcce70ffb75ddf7e121e192ab217

Fixed

6847ee089d7655b2a0eea4fee3133aeacd4cc7cc

Introduced

95aff214687a5e12c3eb57d056665741e734c188

Fixed

0fb782ee38ea37fd5fe8b1f775f8ad866a82a3f0

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.7"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.3"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.1"
        }
    ]
}

Affected versions

Other

v2_7_0

v2_7_1

v2_7_2

v3_0_0

v3.*

v3.1.8

v3.1.9

v3.2.0

v3.2.1

v3.2.2

v3.2.3

v3.2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-28965.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    }
]