CVE-2024-41123: REXML XML Toolkit DoS Vulnerability in Ruby Packages
Summary
CVE-2024-41123: REXML is an XML toolkit for Ruby. Affects ruby-rexml across 2 version ranges.
< 3.3.9-r0
< 085def07425561862d8329001168d8bc9c75ae8f
Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML data. It provides a simple and efficient way to handle XML documents, making it a popular choice among Ruby developers. However, certain versions of the REXML gem are vulnerable to Denial of Service (DoS) attacks when processing XML documents containing specific characters, which can lead to performance degradation or application crashes.
Vulnerability Detail
The vulnerability arises from the way REXML parses XML documents that contain excessive whitespace characters or specific sequences such as ']' and '>'. This can lead to a Denial of Service (DoS) condition, where the application becomes unresponsive or crashes due to excessive resource consumption. The affected versions of the REXML gem prior to 3.3.2 are particularly susceptible, as they lack the necessary safeguards against such input. Attackers could exploit this vulnerability by crafting malicious XML documents, potentially impacting the availability of applications that rely on REXML for XML processing.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize XML documents before processing them with REXML. This can help mitigate the risk of DoS attacks by rejecting potentially harmful input.
Conclusion
CVE-2024-41123 is a significant vulnerability in the REXML gem that can lead to Denial of Service attacks when processing certain XML documents. It is crucial for developers using affected versions to update to 3.3.3 or later to ensure the security and stability of their applications. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ruby-rexml →
FAQ
CVE-2024-41123 is a vulnerability in the REXML gem for Ruby that allows for Denial of Service (DoS) attacks when parsing XML documents with specific characters.
Versions of the REXML gem prior to 3.3.2 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of CVE-2024-41123 is 7.5, indicating a high severity level.
If you cannot update immediately, implement input validation to sanitize XML documents before processing them with REXML to mitigate the risk of DoS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
