CVE-2024-41123: REXML DoS vulnerability
Impact
The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>.
If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.
Patches
The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Workarounds
Don't parse untrusted XMLs.
References
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org
Other sources
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/rexmlto a version that resolves this vulnerability.Fixed in 3.3.3 - Upgrade
Upgrade
debian/ruby3.3to a version that resolves this vulnerability.Fixed in 3.3.8-2Fixed in 3.3.8-2.2 - Upgrade
Upgrade
alpine/ruby-rexmlto a version that resolves this vulnerability.Fixed in 3.3.9-r0 - Upgrade
Upgrade
debian/ruby3.3to a version that resolves this vulnerability.Fixed in 3.3.5-1 - Upgrade
Upgrade
REXML gemto a version that resolves this vulnerability.Fixed in 3.3.3 - Compensating control
Do not parse untrusted XML documents.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41123?
CVE-2024-41123 has been identified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-41123?
To mitigate CVE-2024-41123, upgrade the REXML gem to version 3.3.3 or later.
Which versions of the REXML gem are affected by CVE-2024-41123?
CVE-2024-41123 affects REXML gem versions prior to 3.3.2.
What applications are impacted by CVE-2024-41123?
Applications using vulnerable versions of the REXML gem for parsing untrusted XML are at risk due to CVE-2024-41123.
Are there temporary workarounds for CVE-2024-41123?
There are no specific temporary workarounds recommended for CVE-2024-41123; upgrading to a fixed version is advised.