Critical Security Update for Ruby Packages: REXML ReDoS Vulnerability
Summary
ALSA-2024:10850: Important: ruby:2.5 security update. Affects ruby versions < 2.5.9-113.module_el8.10.0+3932+2d440da3. Fixed in 2.5.9-113.module_el8.10.0+3932+2d440da3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management tasks. It features a rich ecosystem of libraries and frameworks, making it a popular choice among developers. However, recent vulnerabilities have been identified in its libraries, particularly affecting the REXML library, which is responsible for XML parsing. This vulnerability can lead to potential denial-of-service attacks, impacting applications that rely on Ruby for processing XML data.
Vulnerability Detail
The identified vulnerability, known as CVE-2024-49761, is a Regular Expression Denial of Service (ReDoS) vulnerability in the REXML library. This issue arises from the way certain regular expressions are constructed, allowing attackers to exploit them by sending specially crafted XML inputs. The ramifications of this vulnerability can be severe, as it may lead to application crashes or unresponsive states, thereby affecting the availability of services that depend on Ruby applications.
How To Fix
Minimum fixed version
2.5.9-113.module_el8.10.0+3932+2d440da3
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid processing untrusted XML data until the update has been applied. Additionally, consider implementing input validation to filter out potentially harmful XML content.
Conclusion
The REXML ReDoS vulnerability in Ruby poses significant risks to applications that process XML data. It is crucial to update the affected packages to the patched version to ensure the security and stability of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, enhancing your software's security posture.
See every vulnerability recorded for ruby →
FAQ
CVE-2024-49761 is a vulnerability in the REXML library of Ruby that allows for Regular Expression Denial of Service (ReDoS) attacks through specially crafted XML inputs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include potential application crashes and denial of service, which can disrupt the availability of services relying on Ruby applications.
Yes, a patch is available in the form of an updated Ruby package version 2.5.9-113.module_el8.10.0+3932+2d440da3.
If immediate updates cannot be performed, avoid processing untrusted XML data and implement input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
