Logo
›
›vulnerability›CVE-2024-41123
Name
CVE-2024-41123
Source
NVD ( link)Debian ( link)
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CWEs
CWE-400 CWE-400
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8Not Applicable
https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6Vendor Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xghNot Applicable
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123Vendor Advisory

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

5.3
CVSSv31
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
Add position check for XML declaration (#162)
NAITOH Jun <naitoh@gmail.com>
CVE-2024-41123
2
Add missing encode for custom term
Sutou Kouhei <kou@clear-code.com>
CVE-2024-41123
3
Fix source.match performance without specifying term string
tomoya ishida <tomoyapenguin@gmail.com>
CVE-2024-41123
4
parse pi: improve invalid case detection
Sutou Kouhei <kou@clear-code.com>
CVE-2024-41123
5
Fix method scope in test in order to invoke the tests
Watson <watson1978@gmail.com>
CVE-2024-41123