From 8fcd6511f47694c3d5c5fcb536a08076ab3b197e Mon Sep 17 00:00:00 2001 From: Sutou Kouhei Date: Thu, 1 Aug 2024 12:08:50 +0900 Subject: [PATCH] Add CVE-2024-41946: DoS vulnerability in REXML --- .../2024-08-01-dos-rexml-cve-2024-41946.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 en/news/_posts/2024-08-01-dos-rexml-cve-2024-41946.md diff --git a/en/news/_posts/2024-08-01-dos-rexml-cve-2024-41946.md b/en/news/_posts/2024-08-01-dos-rexml-cve-2024-41946.md new file mode 100644 index 0000000000..34cad88476 --- /dev/null +++ b/en/news/_posts/2024-08-01-dos-rexml-cve-2024-41946.md @@ -0,0 +1,29 @@ +--- +layout: news_post +title: "CVE-2024-41946: DoS vulnerability in REXML" +author: "kou" +translator: +date: 2024-08-01 03:00:00 +0000 +tags: security +lang: en +--- + +There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier [CVE-2024-41946](https://www.cve.org/CVERecord?id=CVE-2024-41946). We strongly recommend upgrading the REXML gem. + +## Details + +When parsing an XML that has many entity expansions with SAX2 or pull parser API, REXML gem may take long time. + +Please update REXML gem to version 3.3.3 or later. + +## Affected versions + +* REXML gem 3.3.2 or prior + +## Credits + +Thanks to [NAITOH Jun](https://github.com/naitoh) for discovering and fixing this issue. + +## History + +* Originally published at 2024-08-01 03:00:00 (UTC)