DoS Vulnerability in REXML Package: ruby-rexml Affected by Deep Element Parsing Issue
Summary
ALPINE-CVE-2024-43398: REXML is an XML toolkit for Ruby. Affects ruby-rexml versions < 3.3.9-r0. Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML documents. It provides a simple and intuitive API for developers to work with XML data. However, prior to version 3.3.6, REXML was susceptible to a Denial of Service (DoS) vulnerability when parsing XML documents with deeply nested elements that share the same local name attributes. This vulnerability can lead to performance degradation or application crashes when handling untrusted XML inputs.
Vulnerability Detail
The vulnerability arises from the way REXML processes XML documents with many deep elements that have identical local name attributes. Attackers can craft malicious XML files that exploit this flaw, potentially causing the application to hang or crash while parsing. This issue is particularly concerning for applications that rely on REXML for parsing untrusted XML data, as it can lead to service interruptions and degraded user experience.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider using alternative XML parsing APIs such as the stream parser API or SAX2 parser API, which are not affected by this vulnerability. This can help mitigate the risk while you plan for an upgrade.
Conclusion
The REXML package in Ruby has a critical DoS vulnerability that can affect applications parsing untrusted XML data. It is essential to update to version 3.3.6 or later to mitigate this risk. Additionally, consider using alternative parsing methods as a temporary workaround. Tools like Vulert can help monitor your application for such vulnerabilities.
See every vulnerability recorded for ruby-rexml →
FAQ
The vulnerability is a Denial of Service (DoS) issue that occurs when REXML parses XML documents with many deeply nested elements sharing the same local name attributes.
If your application uses REXML versions prior to 3.3.6 and processes untrusted XML data, it may be vulnerable. You can check your application's dependencies using tools like Vulert.
Exploiting this vulnerability can lead to application crashes or performance issues, particularly when handling complex XML documents.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without needing to access the code directly.
As a temporary measure, consider using alternative XML parsing methods that are not affected by this vulnerability, such as stream or SAX2 parsing.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
