CVE-2024-35176

CVE Details

Release Date:

2024-05-16

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.

See more information about CVE-2024-35176 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.3	CVSS Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (pcs)	ELSA-2024-5338	2024-08-16
Oracle Linux version 8 (ruby)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-abrt)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-bson)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-bundler)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-mongo)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-mysql2)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-pg)	ELSA-2024-4499	2024-07-15