CVE-2024-39908: Denial of service in REXML
Impact
The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>.
If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.
Patches
The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities.
Workarounds
Don't parse untrusted XMLs.
References
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/
Other sources
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
— MITRE
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39908?
CVE-2024-39908 has been classified as a denial-of-service (DoS) vulnerability.
How do I fix CVE-2024-39908?
You can fix CVE-2024-39908 by upgrading to REXML gem version 3.3.2 or later.
Which versions of REXML are affected by CVE-2024-39908?
REXML gem versions before 3.3.2 are affected by CVE-2024-39908.
What types of vulnerabilities are present in CVE-2024-39908?
CVE-2024-39908 presents denial-of-service vulnerabilities due to improper parsing of specific XML characters.
Is CVE-2024-39908 applicable to all Ruby versions?
CVE-2024-39908 primarily affects systems using vulnerable REXML versions regardless of the Ruby version.