AZL-48162 CVE-2024-43398 affecting package ruby for versions less than 3.3.5-1

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2024-43398 vulnerabilities

Vulnerabilities for packages: ruby, jruby, kube-fluentd-operator, ruby3.2-rexml...

CVE-2024-43398 REXML denial of service vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2024-43398

REXML DoS in Ruby: the vulnerability CVE-2024-43398 affects the REXML gem when parsing XMLs with many deep elements that have the same local name attributes. It is exploitable via tree parser usage (e.g., REXML::Document.new); stream parser and SAX2 APIs are not affected. Versions prior to 3.3.6 ...

CVE-2024-43398 REXML denial of service vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2024-43398

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2024-43398 REXML denial of service vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2024-43398

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

PT-2024-6382

Name of the Vulnerable Software and Affected Versions REXML versions prior to 3.3.6 Description The REXML gem has a DoS vulnerability when it parses an XML that has many deep elements that have the same local name attributes. This issue affects users who need to parse untrusted XMLs with the tree...

REXML denial of service vulnerability

Impact The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser...

Ruby: Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXML

The REXML library in Ruby was found to be vulnerable to an issue where parsing a maliciously crafted XML file could lead to uncontrolled resource consumption, resulting in a denial of service. The vulnerability was caused by a flaw in the namespace handling functionality of the REXML library...

pcs security update

0.10.18-2.0.1 - Replace HAM-logo.png with a generic one 0.10.18-2 - Updated rubygem rexml Resolves: RHEL-37883...

Oracle Linux 8 : pcs (ELSA-2024-5338)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-5338 advisory. 0.10.18-2.0.1 - Replace HAM-logo.png with a generic one 0.10.18-2 - Updated rubygem rexml Resolves: RHEL-37883 Tenable has extracted the preceding description...

RHEL 8 : pcs (RHSA-2024:5338)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5338 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: REXML: DoS parsing an XML with...

ALSA-2024:5338 Low: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: REXML: DoS parsing an XML with many s in an attribute value CVE-2024-35176 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Internet Bug Bounty: [CVE-2024-35176] DoS vulnerability in REXML

CVE-2024-35176: DoS vulnerability in REXML A DoS vulnerability was discovered in the REXML gem. A specially crafted XML document with many '' characters in an attribute value could cause REXML to take a long time to parse it. This issue was assigned the CVE identifier CVE-2024-35176. Users were...

Denial Of Service (DoS)

REXML is vulnerable to Denial Of Service DoS. The vulnerability is due to a lack of proper entity expansion limits in its XML parsing with SAX2 or pull parser API. The vulnerability allows for excessive resource consumption when handling XML documents with numerous nested or repeated entities...

SUSE CVE-2024-41123

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, and . The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities...

SUSE CVE-2024-41946

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability...

CVE-2024-41946

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file. Mitigation Mitigation for this issue is either not...