-
Notifications
You must be signed in to change notification settings - Fork 605
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
2 changed files
with
58 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
--- | ||
layout: news_post | ||
title: "CVE-2024-41123: REXML 中的 DoS 漏洞" | ||
author: "kou" | ||
translator: "GAO Jun" | ||
date: 2024-08-01 03:00:00 +0000 | ||
tags: security | ||
lang: zh_cn | ||
--- | ||
|
||
REXML gem 中存在多个 DoS 漏洞。此漏洞的 CVE 编号为 [CVE-2024-41123](https://www.cve.org/CVERecord?id=CVE-2024-41123)。我们强烈建议您更新 REXML gem。 | ||
|
||
## 详情 | ||
|
||
当要处理的 XML 文档中存在很多特定字符时(如空格、`>]` 和 `]>`),REXML gem 可能会花费很长时间。 | ||
|
||
请更新 REXML gem 至 3.3.3 或更高版本。 | ||
|
||
## 受影响版本 | ||
|
||
* REXML gem 3.3.2 或更低版本 | ||
|
||
## 致谢 | ||
|
||
感谢 [mprogrammer](https://hackerone.com/mprogrammer) 和 [scyoon](https://hackerone.com/scyoon) 发现此问题 | ||
|
||
## 历史 | ||
|
||
* 最初发布于 2024-08-01 03:00:00 (UTC) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
--- | ||
layout: news_post | ||
title: "CVE-2024-41946: REXML 中的 DoS 漏洞" | ||
author: "kou" | ||
translator: "GAO Jun" | ||
date: 2024-08-01 03:00:00 +0000 | ||
tags: security | ||
lang: zh_cn | ||
--- | ||
|
||
REXML gem 中存在 DoS 漏洞。此漏洞的 CVE 编号为 [CVE-2024-41946](https://www.cve.org/CVERecord?id=CVE-2024-41946)。我们强烈建议您更新 REXML gem。 | ||
|
||
## 详情 | ||
|
||
当使用 SAX2 或 拉取解析器 API 解析具有许多实体扩展的 XML 时,REXML gem 可能需要很长时间。 | ||
|
||
请更新 REXML gem 至 3.3.3 或更高版本。 | ||
|
||
## 受影响版本 | ||
|
||
* REXML gem 3.3.2 或更低版本 | ||
|
||
## 致谢 | ||
|
||
感谢 [NAITOH Jun](https://github.com/naitoh) 发现此问题。 | ||
|
||
## 历史 | ||
|
||
* 最初发布于 2024-08-01 03:00:00 (UTC) |