Logo
›
›vulnerability›CVE-2024-39908
Name
CVE-2024-39908
Source
NVD ( link)Debian ( link)
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CWEs
CWE-400
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8Vendor Advisory
https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908Vendor Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8Vendor Advisory
https://security.netapp.com/advisory/ntap-20250117-0008/Third Party Advisory
https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908Vendor Advisory

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

4.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
Add a "malformed comment" check for top-level comments (#145)
Hiroya Fujinami <make.just.on@gmail.com>
CVE-2024-39908
2
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
3
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
4
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
5
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
6
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
7
Fix ReDoS caused by very large character references using
Watson <watson1978@gmail.com>
CVE-2024-39908
8
Add support for old strscan
Sutou Kouhei <kou@clear-code.com>
CVE-2024-39908
9
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
10
Remove `Source#string=` method (#117)
NAITOH Jun <naitoh@gmail.com>
CVE-2024-39908
11
Fix performance issue caused by using repeated `>` characters
Watson <watson1978@gmail.com>
CVE-2024-39908
12
Fix ReDoS by using repeated space characters inside
Watson <watson1978@gmail.com>
CVE-2024-39908