CVE-2024-41123: REXML DoS vulnerability
Impact
The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>.
If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.
Patches
The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Workarounds
Don't parse untrusted XMLs.
References
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org
Other sources
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
— MITRE
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41123?
CVE-2024-41123 has been identified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-41123?
To mitigate CVE-2024-41123, upgrade the REXML gem to version 3.3.3 or later.
Which versions of the REXML gem are affected by CVE-2024-41123?
CVE-2024-41123 affects REXML gem versions prior to 3.3.2.
What applications are impacted by CVE-2024-41123?
Applications using vulnerable versions of the REXML gem for parsing untrusted XML are at risk due to CVE-2024-41123.
Are there temporary workarounds for CVE-2024-41123?
There are no specific temporary workarounds recommended for CVE-2024-41123; upgrading to a fixed version is advised.