Critical ReDoS Vulnerability in ruby-rexml Package Affects Multiple Alpine Versions
Summary
ALPINE-CVE-2024-49761: REXML is an XML toolkit for Ruby. Affects ruby-rexml versions < 3.3.9-r0. Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML documents. It provides a simple and efficient way to handle XML data in Ruby applications. However, prior to version 3.3.9, the REXML gem is vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can lead to significant performance degradation when processing certain XML inputs.
Vulnerability Detail
The vulnerability arises from the way REXML parses XML containing hex numeric character references with excessive digits between &# and x...; (e.g., �). This can cause the parser to enter a catastrophic backtracking scenario, leading to high CPU usage and potential denial of service. This issue affects versions of REXML prior to 3.3.9, with Ruby 3.1 being the only maintained version impacted. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, consider sanitizing XML inputs to avoid using hex numeric character references with excessive digits. This can help mitigate the risk of triggering the ReDoS vulnerability.
Conclusion
The REXML vulnerability in ruby-rexml poses a significant risk to applications using affected versions. It is crucial to update to version 3.3.9 or later to mitigate this risk. Additionally, developers should consider input sanitization as a temporary measure until the update can be applied.
See every vulnerability recorded for ruby-rexml →
FAQ
A ReDoS (Regular Expression Denial of Service) vulnerability occurs when a regular expression takes an excessive amount of time to process certain inputs, potentially leading to service unavailability.
Versions of ruby-rexml prior to 3.3.9 are affected by this vulnerability across Alpine versions 3.19, 3.20, 3.21, and 3.22.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not feasible, sanitize your XML inputs to avoid triggering the vulnerability, particularly by limiting the use of hex numeric character references.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
