Denial of Service Vulnerability in REXML Gem 3.3.2 for Ruby Packages
Summary
CVE-2024-41946: REXML is an XML toolkit for Ruby. Affects ruby-rexml across 2 version ranges.
< 3.3.9-r0
< 033d1909a8f259d5a7c53681bcaf14f13bcf0368
Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML documents. It provides a simple and efficient way to handle XML data, making it a popular choice among Ruby developers. However, the REXML gem version 3.3.2 has been identified to have a critical vulnerability that can lead to Denial of Service (DoS) when processing XML files with excessive entity expansions.
Vulnerability Detail
The vulnerability in REXML arises from its handling of XML documents that contain numerous entity expansions. When using the SAX2 or pull parser API, an attacker can craft a malicious XML file that exploits this flaw, leading to resource exhaustion and potentially crashing the application. This vulnerability is particularly concerning as it can be triggered with minimal input, making it easy for attackers to launch a DoS attack.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to implement input validation to restrict the processing of XML files that may contain excessive entity expansions. This can help reduce the risk of triggering the vulnerability until a proper fix is applied.
Conclusion
The REXML gem version 3.3.2 has a critical Denial of Service vulnerability that can be exploited through malicious XML files. Upgrading to version 3.3.3 or later is essential to protect your applications from potential attacks. Implementing input validation can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for ruby-rexml →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
REXML gem version 3.3.2 is affected by this vulnerability. Versions 3.3.3 and later have the patch.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
The primary impact of this vulnerability is Denial of Service (DoS), which can lead to application crashes and unavailability for users.
Yes, implementing input validation to restrict XML processing can help mitigate the risk until you can upgrade to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
