CVE-2024-41123

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8	Not Applicable
https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6	Vendor Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh	Not Applicable
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123	Vendor Advisory
https://security.netapp.com/advisory/ntap-20241227-0005/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:rexml::::::ruby::*
	cpe:2.3:a:ruby-lang:rexml::::::ruby::*

History

27 Dec 2024, 16:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 5.3
References		() https://security.netapp.com/advisory/ntap-20241227-0005/ -

05 Sep 2024, 16:12

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ruby-lang:rexml::::::ruby::*
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 7.5
First Time		Ruby-lang rexml Ruby-lang
References	~~() https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 -~~	() https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 - Not Applicable
References	~~() https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6 -~~	() https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6 - Vendor Advisory
References	~~() https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh -~~	() https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh - Not Applicable
References	~~() https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123 -~~	() https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123 - Vendor Advisory
Summary		(es) REXML es un conjunto de herramientas XML para Ruby. La gema REXML anterior a 3.3.2 tiene algunas vulnerabilidades DoS cuando analiza un XML que tiene muchos caracteres específicos, como espacios en blanco, `>]` y `]>`. La gema REXML 3.3.3 o posterior incluye los parches para corregir estas vulnerabilidades.

01 Aug 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-01 15:15

Updated : 2024-12-27 16:15

NVD link : CVE-2024-41123

Mitre link : CVE-2024-41123

CVE.ORG link : CVE-2024-41123

JSON object : View

Products Affected

ruby-lang

rexml

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2024-41123", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-08-01T15:15:13.213", "references": [{"url": "https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://security.netapp.com/advisory/ntap-20241227-0005/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities."}, {"lang": "es", "value": "REXML es un conjunto de herramientas XML para Ruby. La gema REXML anterior a 3.3.2 tiene algunas vulnerabilidades DoS cuando analiza un XML que tiene muchos caracteres espec\u00edficos, como espacios en blanco, `>]` y `]>`. La gema REXML 3.3.3 o posterior incluye los parches para corregir estas vulnerabilidades."}], "lastModified": "2024-12-27T16:15:24.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "EBF24ACB-780A-4611-B978-F93033207F85", "versionEndExcluding": "3.2.7"}, {"criteria": "cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "35894CC8-FEFA-4F30-A9FF-4582B7DF108C", "versionEndExcluding": "3.3.2", "versionStartIncluding": "3.2.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}

5.3 /10