CVE-2024-39908: Denial of service in REXML
Impact
The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>.
If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.
Patches
The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities.
Workarounds
Don't parse untrusted XMLs.
References
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/
Other sources
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/rexmlto a version that resolves this vulnerability.Fixed in 3.3.2 - Upgrade
Upgrade
debian/ruby3.3to a version that resolves this vulnerability.Fixed in 3.3.8-2Fixed in 3.3.8-2.2 - Upgrade
Upgrade
alpine/ruby-rexmlto a version that resolves this vulnerability.Fixed in 3.3.9-r0 - Upgrade
Upgrade
debian/ruby3.3to a version that resolves this vulnerability.Fixed in 3.3.5-1 - Upgrade
Upgrade
REXML gemto a version that resolves this vulnerability.Fixed in 3.3.2 - Compensating control
Avoid parsing untrusted XML strings if unable to upgrade.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39908?
CVE-2024-39908 has been classified as a denial-of-service (DoS) vulnerability.
How do I fix CVE-2024-39908?
You can fix CVE-2024-39908 by upgrading to REXML gem version 3.3.2 or later.
Which versions of REXML are affected by CVE-2024-39908?
REXML gem versions before 3.3.2 are affected by CVE-2024-39908.
What types of vulnerabilities are present in CVE-2024-39908?
CVE-2024-39908 presents denial-of-service vulnerabilities due to improper parsing of specific XML characters.
Is CVE-2024-39908 applicable to all Ruby versions?
CVE-2024-39908 primarily affects systems using vulnerable REXML versions regardless of the Ruby version.