Logo
›
›vulnerability›CVE-2024-43398
Name
CVE-2024-43398
Source
NVD ( link)Debian ( link)
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
CWEs
CWE-776
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ruby/rexml/releases/tag/v3.3.6Release Notes
https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3Vendor Advisory
https://security.netapp.com/advisory/ntap-20250103-0006/Third Party Advisory

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

5.9
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
parser tree: improve namespace conflicted attribute check
Sutou Kouhei <kou@clear-code.com>
CVE-2024-43398
2
Optimize the parse_attributes method to use `Source#match`
NAITOH Jun <naitoh@gmail.com>
CVE-2024-43398
3
parser: keep the current namespaces instead of stack of Set
Sutou Kouhei <kou@clear-code.com>
CVE-2024-43398