Critical DoS Vulnerability in ruby-rexml Package: Upgrade Recommended
Summary
ALPINE-CVE-2024-39908: REXML is an XML toolkit for Ruby. Affects ruby-rexml versions < 3.3.9-r0. Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML documents. It provides a simple and efficient way to handle XML data, making it a popular choice among Ruby developers. However, certain versions of the REXML gem have been found to contain vulnerabilities that can lead to Denial of Service (DoS) attacks when processing untrusted XML inputs.
Vulnerability Detail
The REXML gem versions prior to 3.3.1 are susceptible to Denial of Service (DoS) vulnerabilities when parsing XML documents containing specific characters such as '<', '0', and '%>'. These vulnerabilities can be exploited by attackers to cause excessive resource consumption, potentially leading to application crashes or unresponsiveness. The vulnerabilities stem from inadequate handling of certain XML constructs, making it critical for users to ensure they are using a patched version of the gem.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users are advised to avoid parsing untrusted XML strings to mitigate the risk of exploitation. Implementing input validation and sanitization can also help reduce the attack surface.
Conclusion
The ruby-rexml package has a critical vulnerability that can lead to Denial of Service attacks when parsing untrusted XML. Users are strongly advised to upgrade to the patched version 3.3.2 or later to protect their applications. For those unable to upgrade immediately, avoiding untrusted XML parsing is recommended.
See every vulnerability recorded for ruby-rexml →
FAQ
REXML is an XML toolkit for Ruby that allows developers to parse and manipulate XML documents easily.
Versions of ruby-rexml prior to 3.3.1 are affected by the Denial of Service vulnerabilities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an upgrade is not feasible, avoid parsing untrusted XML strings and implement input validation to mitigate risks.
More information can be found in the CVE report for ALPINE-CVE-2024-39908, which details the vulnerabilities and their implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
