REDHAT-BUG-2302272: Low severity Ruby REXML vulnerability
Published Aug 1, 2024
·Updated
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
Affected Software
1 affected component
Ruby REXML<3.3.3
Event History
Aug 1, 2024
Data Sourced
via Red Hat·03:31 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2302272?
The severity of REDHAT-BUG-2302272 is classified as a denial of service (DoS) vulnerability.
2
How do I fix REDHAT-BUG-2302272?
To fix REDHAT-BUG-2302272, upgrade the REXML gem to version 3.3.3 or later.
3
What versions are affected by REDHAT-BUG-2302272?
REXML gem versions prior to 3.3.3 are affected by the vulnerability identified in REDHAT-BUG-2302272.
4
What is the nature of the vulnerability in REDHAT-BUG-2302272?
The vulnerability in REDHAT-BUG-2302272 allows for a denial of service attack when parsing XML with excessive entity expansions.
5
What tools are impacted by REDHAT-BUG-2302272?
The REXML toolkit for Ruby is impacted by the vulnerability described in REDHAT-BUG-2302272.