Author:
Source
There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-49761. We strongly recommend upgrading the REXML gem.
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
Details
When parsing an XML that has many digits between &#
and x...;
in a hex numeric character reference (&#x...;
).
Please update REXML gem to version 3.3.9 or later.
Affected versions
- REXML gem 3.3.8 or prior with Ruby 3.1 or prior
Credits
Thanks to manun for discovering this issue.
History
- Originally published at 2024-10-28 03:00:00 (UTC)
Posted by kou on 28 Oct 2024