Critical Security Update for Ruby: Addressing REXML ReDoS Vulnerability
Summary
ALSA-2024:10834: Important: ruby:3.1 security update. Affects ruby versions < 3.1.5-144.module_el8.10.0+3933+43481280. Fixed in 3.1.5-144.module_el8.10.0+3933+43481280. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management tasks. It features a rich set of libraries and frameworks, making it a popular choice among developers. However, recent vulnerabilities have emerged, including a critical ReDoS (Regular Expression Denial of Service) issue in the REXML library, which can severely impact applications relying on Ruby for XML processing.
Vulnerability Detail
The vulnerability identified as CVE-2024-49761 affects the REXML library within Ruby. This issue arises from the way REXML processes regular expressions, allowing an attacker to exploit this by crafting specific XML inputs that can lead to excessive resource consumption. As a result, this can cause denial of service, making the application unresponsive and potentially leading to downtime. The vulnerability is particularly concerning for applications that handle untrusted XML data, as it can be triggered remotely without authentication.
How To Fix
Minimum fixed version
3.1.5-144.module_el8.10.0+3933+43481280
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize XML data before processing it with REXML. This can help mitigate the risk of triggering the vulnerability. Additionally, avoid processing untrusted XML data whenever possible.
Conclusion
The REXML ReDoS vulnerability in Ruby poses a significant risk to applications that process XML data. It is crucial to update to the latest patched version of Ruby and its associated packages to safeguard against potential denial of service attacks. Implementing input validation can serve as a temporary measure until updates can be applied.
See every vulnerability recorded for ruby →
FAQ
The REXML ReDoS vulnerability allows attackers to exploit regular expression processing in the REXML library, leading to denial of service by consuming excessive resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to fix this vulnerability can lead to application downtime, unresponsiveness, and potential data loss, especially for applications processing untrusted XML data.
Yes, you should upgrade to Ruby version 3.1.5-144.module_el8.10.0+3933+43481280 or later to ensure the vulnerability is patched.
If you cannot update immediately, implement input validation to sanitize XML data and avoid processing untrusted XML to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
