REDHAT-BUG-2322153: Medium severity rexml vulnerability

Published Oct 28, 2024

Updated

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Affected Software

2 affected components

Ruby REXML<3.3.9

Ruby Ruby>3.1

Event History

Oct 28, 2024

Data Sourced

via Red Hat·03:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2322153?

The severity of REDHAT-BUG-2322153 is categorized as a ReDoS vulnerability that can affect system performance when parsing certain XML structures.

How do I fix REDHAT-BUG-2322153?

To fix REDHAT-BUG-2322153, upgrade the REXML gem to version 3.3.9 or later, or switch to Ruby version 3.2 or newer.

Which versions of Ruby are affected by REDHAT-BUG-2322153?

Ruby versions prior to 3.3.9 and Ruby 3.1 are affected by REDHAT-BUG-2322153.

What is REXML in relation to REDHAT-BUG-2322153?

REXML is an XML parsing toolkit for Ruby, which is vulnerable to ReDoS in specific conditions as described in REDHAT-BUG-2322153.

Can I use Ruby 3.2 or later to avoid REDHAT-BUG-2322153?

Yes, using Ruby version 3.2 or later will help you avoid the ReDoS vulnerability outlined in REDHAT-BUG-2322153.