Lucene search

[email protected]NVD:CVE-2024-41123

HistoryAug 01, 2024 - 3:15 p.m.

CVE-2024-41123

2024-08-0115:15:13

CWE-400

[email protected]

web.nvd.nist.gov

rexml

xml

toolkit

dos

vulnerabilities

fix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

23.8%

JSON

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

Affected configurations

Nvd

Node

ruby-langrexmlRange<3.3.3ruby

VendorProductVersionCPE
ruby-langrexml*cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*

Vendor	Product	Version	CPE
ruby-lang	rexml	*	cpe:2.3:a:ruby-lang:rexml::::::ruby::*

References

github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8

github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6

github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh

www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

23.8%

JSON

Related for NVD:CVE-2024-41123

osv11 github1 debiancve1 cve1 veracode1 redhatcve1 rubygems1 cvelist1 wolfi1 alpinelinux1 vulnrichment1 nessus6 almalinux1 redhat5 redos1 rocky1 oraclelinux2 ibm1