REXML XML Round-Trip Issue in Ruby Package - CVE-2021-28965
Summary
ALPINE-CVE-2021-28965: The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. Affects ruby versions < 2.5.9-r0. Fixed in 2.5.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. The REXML gem is a part of Ruby's standard library, providing tools for parsing and manipulating XML documents. However, prior versions of REXML have been found to have vulnerabilities that can lead to incorrect XML document generation after parsing and serialization.
Vulnerability Detail
The vulnerability identified as CVE-2021-28965 affects the REXML gem in Ruby versions prior to 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1. This issue arises from improper handling of XML round-trip processes, which can result in the generation of incorrect XML documents. The ramifications of this vulnerability include potential data integrity issues, as malformed XML documents may lead to unexpected behavior in applications that rely on accurate XML parsing and serialization.
How To Fix
Minimum fixed version
2.5.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the REXML gem for XML parsing and serialization until the package is updated. Alternatively, consider using other XML processing libraries that do not exhibit this vulnerability.
Conclusion
CVE-2021-28965 presents a significant risk to applications using vulnerable versions of the REXML gem in Ruby. It is crucial for developers to update their Ruby packages to the patched versions to mitigate potential data integrity issues. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby →
FAQ
CVE-2021-28965 is a vulnerability in the REXML gem of Ruby that can lead to incorrect XML document generation due to improper handling of XML round-trip processes.
Ruby versions before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 are affected by this vulnerability.
The primary risk is the generation of malformed XML documents, which can lead to data integrity issues and unexpected behavior in applications relying on accurate XML processing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-28965 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
