CVE-2024-49761

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Configurations

Configuration 1 (hide)

cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*

History

05 Nov 2024, 16:41

Type Values Removed Values Added
References () https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f - () https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f - Patch
References () https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m - () https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m - Third Party Advisory
References () https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761 - () https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761 - Vendor Advisory
CPE cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*
First Time Ruby-lang rexml
Ruby-lang
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5

29 Oct 2024, 14:34

Type Values Removed Values Added
Summary
  • (es) REXML es un conjunto de herramientas XML para Ruby. La gema REXML anterior a la versión 3.3.9 tiene una vulnerabilidad ReDoS cuando analiza un XML que tiene muchos dígitos entre &# y x...; en una referencia de carácter numérico hexadecimal (&#x...;). Esto no sucede con Ruby 3.2 o posterior. Ruby 3.1 es el único Ruby afectado que se mantiene. La gema REXML 3.3.9 o posterior incluye el parche para corregir la vulnerabilidad.

28 Oct 2024, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-28 15:15

Updated : 2024-11-05 16:41


NVD link : CVE-2024-49761

Mitre link : CVE-2024-49761

CVE.ORG link : CVE-2024-49761


JSON object : View

Products Affected

ruby-lang

  • rexml
CWE
CWE-1333

Inefficient Regular Expression Complexity