Critical REXML ReDoS Vulnerability in Ruby Packages
Summary
ALSA-2024:10858: Important: ruby security update. Affects ruby versions < 3.0.7-163.el9_5. Fixed in 3.0.7-163.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management. It features a rich set of libraries and tools, making it a popular choice among developers. However, certain versions of Ruby packages, particularly those utilizing the REXML library, are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance and availability.
Vulnerability Detail
The vulnerability identified as CVE-2024-49761 affects the REXML library within Ruby. This issue arises from the way REXML processes regular expressions, allowing attackers to exploit this functionality by crafting specific inputs that cause excessive backtracking. As a result, this can lead to significant delays in processing, potentially causing denial of service in applications that rely on REXML for XML parsing. The implications of this vulnerability can range from degraded performance to complete application unavailability, making it critical for affected users to address it promptly.
How To Fix
Minimum fixed version
3.0.7-163.el9_5
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize user inputs before processing them with REXML. This can help mitigate the risk of ReDoS attacks by preventing malicious input from being processed.
Conclusion
The REXML ReDoS vulnerability in Ruby packages poses a significant risk to applications that utilize this library for XML processing. It is crucial for developers and system administrators to update their Ruby installations and related packages to the latest patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for ruby →
FAQ
A Regular Expression Denial of Service (ReDoS) attack exploits the way regular expressions are processed, causing excessive backtracking and leading to performance degradation or application crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Failure to address this vulnerability can lead to application downtime, degraded performance, and potential exploitation by malicious actors, which could compromise sensitive data.
Yes, updating to Ruby version 3.0.7-163.el9_5 or later will mitigate the REXML ReDoS vulnerability.
Detailed information about CVE-2024-49761 can be found on the official CVE page and through security advisories related to Ruby packages.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
