REDHAT-BUG-2302268: Medium severity Ruby REXML vulnerability
Published Aug 1, 2024
·Updated
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Affected Software
1 affected component
Ruby REXML<3.3.2
Event History
Aug 1, 2024
Data Sourced
via Red Hat·03:30 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2302268?
The severity of REDHAT-BUG-2302268 is considered to be critical due to potential denial of service vulnerabilities.
2
How do I fix REDHAT-BUG-2302268?
To fix REDHAT-BUG-2302268, upgrade the REXML gem to version 3.3.3 or later.
3
Which versions of REXML are affected by REDHAT-BUG-2302268?
REXML gem versions prior to 3.3.2 are affected by REDHAT-BUG-2302268.
4
What type of vulnerabilities are associated with REDHAT-BUG-2302268?
REDAHT-BUG-2302268 is associated with denial of service (DoS) vulnerabilities when parsing specially crafted XML.
5
Is there a workaround for REDHAT-BUG-2302268?
There is no specific workaround for REDHAT-BUG-2302268; upgrading to the patched version is recommended.