GHSA-8cr8-4vfw-mr7h BIT-ruby-2021-28965 BIT-ruby-min-2021-28965 CVE-2021-28965
REXML round-trip instability
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 5.06%
- Chance of exploitation in the next 30 days. Higher than 92.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-115 Misinterpretation of Input
- CWE-611 Improper Restriction of XML External Entity Reference
- Fix
3.2.5- Upgrade rexml to this version or later
Description
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rexml | < 3.2.5 |
3.2.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rexml RubyGems → 3.2.5
- bundler
bundle update rexml # Gemfile: gem "rexml", ">= 3.2.5"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-115: Misinterpretation of Input
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it
- Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
References
Advisories
Packages
Other links
- github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b
- github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377
- github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752
- github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e
- github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8
- github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551
- github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618
- hackerone.com/reports/1104077
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFT…
- rubygems.org/gems/rexml
- security.netapp.com/advisory/ntap-20210528-0003
- ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c2f4-jgmc-q2r5 REXML has DoS condition when parsing malformed XML file | Medium | Also affects rexml |
| GHSA-2rxp-v6pw-ch6m REXML ReDoS vulnerability | High | Also affects rexml |
| GHSA-vmwr-mc7x-5vc3 REXML denial of service vulnerability | Medium | Also affects rexml |
| GHSA-5866-49gr-22v4 REXML DoS vulnerability | High | Also affects rexml |
| GHSA-r55c-59qm-vjw6 REXML DoS vulnerability | High | Also affects rexml |
| GHSA-4xqq-m2hx-25v8 REXML denial of service vulnerability | Medium | Also affects rexml |
| GHSA-vg3r-rm7w-2xgh REXML contains a denial of service vulnerability | Medium | Also affects rexml |
| GHSA-8jr5-v98p-w75m vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations | Medium | Same weakness, CWE-115 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor