github - ghsa-5866-49gr-22v4

ghsa-5866-49gr-22v4

Vulnerability from github

Published

2024-08-02 12:33

Modified

2025-01-17 21:31

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

REXML DoS vulnerability

Details

Impact

The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API.

If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability.

Patches

The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

Workarounds

Don't parse untrusted XMLs with SAX2 or pull parser API.

References

https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "RubyGems",
            name: "rexml",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "3.3.3",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2024-41946",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-400",
         "CWE-770",
      ],
      github_reviewed: true,
      github_reviewed_at: "2024-08-02T12:33:15Z",
      nvd_published_at: "2024-08-01T15:15:14Z",
      severity: "MODERATE",
   },
   details: "### Impact\n\nThe REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API.\n\nIf you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability.\n\n### Patches\n\nThe REXML gem 3.3.3 or later include the patch to fix the vulnerability.\n\n### Workarounds\n\nDon't parse untrusted XMLs with SAX2 or pull parser API.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability\n* https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org",
   id: "GHSA-5866-49gr-22v4",
   modified: "2025-01-17T21:31:39Z",
   published: "2024-08-02T12:33:15Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-41946",
      },
      {
         type: "WEB",
         url: "https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/ruby/rexml",
      },
      {
         type: "WEB",
         url: "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-41946.yml",
      },
      {
         type: "WEB",
         url: "https://security.netapp.com/advisory/ntap-20250117-0007",
      },
      {
         type: "WEB",
         url: "https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml",
      },
      {
         type: "WEB",
         url: "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
         type: "CVSS_V3",
      },
      {
         score: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
         type: "CVSS_V4",
      },
   ],
   summary: "REXML DoS vulnerability",
}

cve-2024-41946

Vulnerability from cvelistv5

Published

2024-08-01 14:22

Modified

2025-01-17 20:02

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

References

▼	URL	Tags
	https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4	x_refsource_CONFIRM
	https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368	x_refsource_MISC
	https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml	x_refsource_MISC
	https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ruby	rexml	Version: < 3.3.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "rexml",
                  vendor: "ruby-lang",
                  versions: [
                     {
                        lessThan: "3.3.3",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-41946",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-08-01T15:45:10.507112Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-08-01T15:50:11.993Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-01-17T20:02:56.618Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250117-0007/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "rexml",
               vendor: "ruby",
               versions: [
                  {
                     status: "affected",
                     version: "< 3.3.3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400: Uncontrolled Resource Consumption",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-08-01T14:22:14.014Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4",
            },
            {
               name: "https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368",
            },
            {
               name: "https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml",
            },
            {
               name: "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946",
            },
         ],
         source: {
            advisory: "GHSA-5866-49gr-22v4",
            discovery: "UNKNOWN",
         },
         title: "REXML DoS vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-41946",
      datePublished: "2024-08-01T14:22:14.014Z",
      dateReserved: "2024-07-24T16:51:40.948Z",
      dateUpdated: "2025-01-17T20:02:56.618Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-5866-49gr-22v4

Vulnerability from github

Impact

Patches

Workarounds

References

cve-2024-41946

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature