REDHAT-BUG-2302272: Low severity Ruby REXML vulnerability
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REXML gemto a version that resolves this vulnerability.Fixed in 3.3.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2302272?
The severity of REDHAT-BUG-2302272 is classified as a denial of service (DoS) vulnerability.
How do I fix REDHAT-BUG-2302272?
To fix REDHAT-BUG-2302272, upgrade the REXML gem to version 3.3.3 or later.
What versions are affected by REDHAT-BUG-2302272?
REXML gem versions prior to 3.3.3 are affected by the vulnerability identified in REDHAT-BUG-2302272.
What is the nature of the vulnerability in REDHAT-BUG-2302272?
The vulnerability in REDHAT-BUG-2302272 allows for a denial of service attack when parsing XML with excessive entity expansions.
What tools are impacted by REDHAT-BUG-2302272?
The REXML toolkit for Ruby is impacted by the vulnerability described in REDHAT-BUG-2302272.