p PatchFirst

CVE-2024-41946

CVE-2024-41946 · REXML DoS vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

CVSS 5.3 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • rexml

    Versions
    • < 3.3.3: Affected

    No fix published

  • ruby3.1 Debian:12

    Versions
    • 3.1.2-7
    • 3.1.2-7+deb12u1
    • 3.1.2-7+hurd.1
    • 3.1.2-8
    • 3.1.2-8.1~exp1
    • 3.1.2-8.3
    • 3.1.2-8.4
    • 3.1.2-8.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.3.5-1

    Update to 3.3.5-1

  • ruby3.3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.3.5-1

    Update to 3.3.5-1

  • jruby Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.6-5ubuntu1
    • 1.5.6-6
    • 1.5.6-7
    • 1.5.6-9+deb8u2build0.14.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.3 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    • 2.3.1-2~16.04.12
    • 2.3.1-2~ubuntu16.04.13
    • 2.3.1-2~ubuntu16.04.14
    • 2.3.1-2~ubuntu16.04.15
    • 2.3.1-2~ubuntu16.04.16
    • 2.3.1-2~ubuntu16.04.16+esm1
    • 2.3.1-2~ubuntu16.04.16+esm2
    • 2.3.1-2~ubuntu16.04.16+esm3
    • 2.3.1-2~ubuntu16.04.16+esm4
    • 2.3.1-2~ubuntu16.04.16+esm5
    • 2.3.1-2~ubuntu16.04.16+esm6
    • 2.3.1-2~ubuntu16.04.16+esm7
    • 2.3.1-2~ubuntu16.04.16+esm8
    • 2.3.1-2~ubuntu16.04.16+esm9
    • 2.3.1-2~ubuntu16.04.16+esm10
    Affected ranges
    • ECOSYSTEM: < 2.3.1-2~ubuntu16.04.16+esm11

    Update to 2.3.1-2~ubuntu16.04.16+esm11

  • jruby Ubuntu:16.04:LTS

    Versions
    • 1.7.21-2ubuntu4
    • 1.7.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.5 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    • 2.5.1-1ubuntu1.2
    • 2.5.1-1ubuntu1.4
    • 2.5.1-1ubuntu1.5
    • 2.5.1-1ubuntu1.6
    • 2.5.1-1ubuntu1.7
    • 2.5.1-1ubuntu1.8
    • 2.5.1-1ubuntu1.9
    • 2.5.1-1ubuntu1.10
    • 2.5.1-1ubuntu1.11
    • 2.5.1-1ubuntu1.12
    • 2.5.1-1ubuntu1.13
    • 2.5.1-1ubuntu1.14
    • 2.5.1-1ubuntu1.15
    • 2.5.1-1ubuntu1.16
    • 2.5.1-1ubuntu1.16+esm1
    • 2.5.1-1ubuntu1.16+esm3
    • 2.5.1-1ubuntu1.16+esm4
    • 2.5.1-1ubuntu1.16+esm5
    Affected ranges
    • ECOSYSTEM: < 2.5.1-1ubuntu1.16+esm6

    Update to 2.5.1-1ubuntu1.16+esm6

  • jruby Ubuntu:18.04:LTS

    Versions
    • 9.1.13.0-1
    • 9.1.17.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.7 Ubuntu:20.04:LTS

    Versions
    • 2.7.0-1
    • 2.7.0-2
    • 2.7.0-3
    • 2.7.0-4
    • 2.7.0-4ubuntu1
    • 2.7.0-5ubuntu1
    • 2.7.0-5ubuntu1.1
    • 2.7.0-5ubuntu1.2
    • 2.7.0-5ubuntu1.3
    • 2.7.0-5ubuntu1.4
    • 2.7.0-5ubuntu1.5
    • 2.7.0-5ubuntu1.6
    • 2.7.0-5ubuntu1.7
    • 2.7.0-5ubuntu1.8
    • 2.7.0-5ubuntu1.9
    • 2.7.0-5ubuntu1.10
    • 2.7.0-5ubuntu1.11
    • 2.7.0-5ubuntu1.12
    • 2.7.0-5ubuntu1.13
    • 2.7.0-5ubuntu1.14
    Affected ranges
    • ECOSYSTEM: < 2.7.0-5ubuntu1.15

    Update to 2.7.0-5ubuntu1.15

  • jruby Ubuntu:20.04:LTS

    Versions
    • 9.1.17.0-3
    • 9.1.17.0-3build5
    • 9.1.17.0-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.0 Ubuntu:22.04:LTS

    Versions
    • 3.0.2-5ubuntu1
    • 3.0.2-7
    • 3.0.2-7ubuntu2
    • 3.0.2-7ubuntu2.1
    • 3.0.2-7ubuntu2.2
    • 3.0.2-7ubuntu2.3
    • 3.0.2-7ubuntu2.4
    • 3.0.2-7ubuntu2.5
    • 3.0.2-7ubuntu2.6
    • 3.0.2-7ubuntu2.7
    Affected ranges
    • ECOSYSTEM: < 3.0.2-7ubuntu2.8

    Update to 3.0.2-7ubuntu2.8

  • jruby Ubuntu:24.04:LTS

    Versions
    • 9.3.9.0+ds-1
    • 9.4.5.0+ds-1
    • 9.4.5.0+ds-1ubuntu1
    • 9.4.6.0+ds-1ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.2 Ubuntu:24.04:LTS

    Versions
    • 3.2.3-1
    • 3.2.3-1build2
    • 3.2.3-1build3
    • 3.2.3-1ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: < 3.2.3-1ubuntu0.24.04.3

    Update to 3.2.3-1ubuntu0.24.04.3

  • jruby Ubuntu:25.10

    Versions
    • 9.4.8.0+ds-2ubuntu1
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.10

    Versions
    • 9.4.8.0+ds-3ubuntu1
    • 9.4.14.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.04:LTS

    Versions
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →