CVE-2024-35176 - OpenCVE

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux
Ruby-lang	Rexml

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
ruby:2.5-8100020240627152904.489197e6	cpe:/a:redhat:enterprise_linux:8	RHSA-2024:4499	2024-07-11T00:00:00Z
pcs-0:0.10.18-2.el8_10.1	cpe:/a:redhat:enterprise_linux:8::highavailability	RHSA-2024:5338	2024-08-13T00:00:00Z

References

Link	Providers
https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
https://nvd.nist.gov/vuln/detail/CVE-2024-35176
https://www.cve.org/CVERecord?id=CVE-2024-35176
https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176

History

Fri, 16 Aug 2024 18:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:enterprise_linux:8::highavailability

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-05-16T15:13:25.100Z

Updated: 2024-08-02T03:07:46.804Z

Reserved: 2024-05-10T14:24:24.338Z

Link: CVE-2024-35176

Vulnrichment

Updated: 2024-05-16T18:27:28.936Z

NVD

Status : Awaiting Analysis

Published: 2024-05-16T16:15:09.707

Modified: 2024-05-17T18:36:31.297

Link: CVE-2024-35176

Redhat

Severity : Low

Publid Date: 2024-05-16T00:00:00Z

Links: CVE-2024-35176 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35176", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-10T14:24:24.338Z", "datePublished": "2024-05-16T15:13:25.100Z", "dateUpdated": "2024-08-02T03:07:46.804Z"}, "containers": {"cna": {"title": "REXML contains a denial of service vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh"}, {"name": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb"}, {"name": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176", "tags": ["x_refsource_MISC"], "url": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176"}], "affected": [{"vendor": "ruby", "product": "rexml", "versions": [{"version": "< 3.2.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-16T15:13:25.100Z"}, "descriptions": [{"lang": "en", "value": " REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs."}], "source": {"advisory": "GHSA-vg3r-rm7w-2xgh", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "ruby-lang", "product": "rexml", "cpes": ["cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.2.7", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-16T18:26:15.797427Z", "id": "CVE-2024-35176", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T15:47:54.116Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:07:46.804Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh"}, {"name": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb"}, {"name": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35176", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-16T18:26:15.797427Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*"], "vendor": "ruby-lang", "product": "rexml", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.7", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-16T18:27:28.936Z"}}], "cna": {"title": "REXML contains a denial of service vulnerability", "source": {"advisory": "GHSA-vg3r-rm7w-2xgh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ruby", "product": "rexml", "versions": [{"status": "affected", "version": "< 3.2.7"}]}], "references": [{"url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "name": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb", "name": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb", "tags": ["x_refsource_MISC"]}, {"url": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176", "name": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": " REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-16T15:13:25.100Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35176", "state": "PUBLISHED", "dateUpdated": "2024-08-01T15:47:54.116Z", "dateReserved": "2024-05-10T14:24:24.338Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-16T15:13:25.100Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected_release": [{"advisory": "RHSA-2024:4499", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "ruby:2.5-8100020240627152904.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-07-11T00:00:00Z"}, {"advisory": "RHSA-2024:5338", "cpe": "cpe:/a:redhat:enterprise_linux:8::highavailability", "package": "pcs-0:0.10.18-2.el8_10.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-13T00:00:00Z"}], "bugzilla": {"description": "REXML: DoS parsing an XML with many `<`s in an attribute value", "id": "2280894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280894"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "verified"}, "cwe": "(CWE-400|CWE-770)", "details": ["REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs."], "name": "CVE-2024-35176", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "ruby:3.1/ruby", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "ruby:3.3/ruby", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "ruby:3.1/ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "ruby:3.3/ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "ruby", "product_name": "Red Hat Storage 3"}], "public_date": "2024-05-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35176\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35176\nhttps://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh\nhttps://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176"], "threat_severity": "Low", "upstream_fix": "REXML 3.2.7"}