GHSA-vg3r-rm7w-2xgh

Source

https://github.com/advisories/GHSA-vg3r-rm7w-2xgh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-vg3r-rm7w-2xgh/GHSA-vg3r-rm7w-2xgh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vg3r-rm7w-2xgh

Aliases

CVE-2024-35176

Related

Published

2024-05-16T17:44:04Z

Modified

2024-11-11T23:56:44.908639Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

REXML contains a denial of service vulnerability

Details

Impact

The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many <s in an attribute value.

If you need to parse untrusted XMLs, you may be impacted to this vulnerability.

Patches

The REXML gem 3.2.7 or later include the patch to fix this vulnerability.

Workarounds

Don't parse untrusted XMLs.

References

https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

Database specific

{
    "nvd_published_at": "2024-05-16T16:15:09Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-16T17:44:04Z"
}

References

Affected packages

RubyGems / rexml

Package

Name: rexml
Purl: pkg:gem/rexml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.2.7

Affected versions

3.*

3.1.7.3

3.1.8

3.1.9

3.1.9.1

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6