Input validation error in REXML - CVE-2024-39908

Vulnerability identifier: #VU94363

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-39908

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass specially crafted characters, such as "<", "\0" and "%>" to the application and perform a denial of service (DoS) attack.

REXML
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
Ubuntu
openEuler
Software Support App (iOS)
APEX Cloud Platform for Microsoft Azure
Software Support app (Android)
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)
IBM Cloud Pak for Watson AIOps
Watson CP4D Data Stores
Dell EMC VxRail Appliance
IBM License Metric Tool
rubygem-rss
rubygem-abrt-doc
rubygem-abrt
rubygem-mysql2-doc
rubygem-mysql2
rubygem-io-console
rubygem-typeprof
rubygem-rbs
rubygem-did_you_mean
rubygem-pg-doc
rubygem-pg
rubygem-racc
rubygem-irb
rubygem-power_assert
rubygem-openssl
rubygem-bundler
ruby2.3 (Ubuntu package)
rubygem-json
ruby2.5-stdlib-debuginfo
ruby2.5-devel
ruby2.5-debuginfo
ruby2.5-devel-extra
ruby2.5-stdlib
ruby2.5
libruby2_5-2_5-debuginfo
libruby2_5-2_5
ruby2.5-debugsource
libruby2.7 (Ubuntu package)
ruby2.7 (Ubuntu package)
rubygem-bigdecimal
ruby-irb
ruby-help
ruby-devel
ruby-debugsource
ruby-debuginfo
ruby
ruby3.2 (Ubuntu package)
libruby3.2 (Ubuntu package)
rubygem-rexml
rubygems
rubygems-devel
rubygem-psych
libruby3.3 (Ubuntu package)
ruby3.3 (Ubuntu package)
ruby-doc
ruby-default-gems
ruby-bundled-gems
ruby-libs
rubygem-test-unit
dev-ruby/rexml
rubygem-minitest
rubygem-rdoc
rubygem-rake
libruby3.0 (Ubuntu package)
ruby3.0 (Ubuntu package)
APEX Cloud Platform for Red Hat OpenShift
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data

Install updates from vendor's website.

REXML - update to 3.3.2
Software Support App (iOS) - update to 2.0.0
APEX Cloud Platform for Microsoft Azure - update to 01.04.00.00
Software Support app (Android) - update to 2.0.0
Dell EMC VxRail Appliance - addressed in versions 7.0.533, 8.320
IBM License Metric Tool - update to 9.2.37
rubygem-rss - update to 0.2.9-139
rubygem-rss - update to 0.3.1-3
rubygem-abrt-doc - update to 0.4.0-1
rubygem-abrt - update to 0.4.0-1
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-io-console - update to 0.5.7-139
rubygem-io-console - update to 0.7.1-3
rubygem-typeprof - update to 0.15.2-139
rubygem-typeprof - update to 0.21.9-3
Cognos Analytics Mobile (Android) - update to 1.1.20
Cognos Analytics Mobile (iOS) - update to 1.1.20
rubygem-rbs - update to 1.4.0-139
rubygem-did_you_mean - update to 1.5.0-139
rubygem-pg-doc - update to 1.5.4-1
rubygem-pg - update to 1.5.4-1
rubygem-racc - update to 1.7.3-3
rubygem-irb - update to 1.13.1-3
rubygem-power_assert - update to 2.0.3-3
rubygem-openssl - update to 2.2.1-139
rubygem-bundler - update to 2.2.32-139
ruby2.3 (Ubuntu package) - addressed in versions 2.3.1-2~ubuntu16.04.16+esm11, 2.5.1-1ubuntu1.16+esm6, 2.7.0-5ubuntu1.18+esm3
rubygem-json - update to 2.5.1-139
ruby2.5-stdlib-debuginfo - update to 2.5.9-150000.4.32.1
ruby2.5-devel - update to 2.5.9-150000.4.32.1
ruby2.5-debuginfo - update to 2.5.9-150000.4.32.1
ruby2.5-devel-extra - update to 2.5.9-150000.4.32.1
ruby2.5-stdlib - update to 2.5.9-150000.4.32.1
ruby2.5 - update to 2.5.9-150000.4.32.1
libruby2_5-2_5-debuginfo - update to 2.5.9-150000.4.32.1
libruby2_5-2_5 - update to 2.5.9-150000.4.32.1
ruby2.5-debugsource - update to 2.5.9-150000.4.32.1
rubygem-bundler - update to 2.5.16-3
libruby2.7 (Ubuntu package) - addressed in versions 2.7.0-5ubuntu1.15, 2.7.0-5ubuntu1.16
ruby2.7 (Ubuntu package) - addressed in versions 2.7.0-5ubuntu1.15, 2.7.0-5ubuntu1.16
rubygem-json - update to 2.7.1-3
rubygem-bigdecimal - update to 3.0.0-139
libruby3.0 (Ubuntu package) - update to 3.0.2-7ubuntu2.8
ruby3.0 (Ubuntu package) - update to 3.0.2-7ubuntu2.8
ruby-irb - update to 3.0.3-139
ruby-help - update to 3.0.3-139
ruby-devel - update to 3.0.3-139
ruby-debugsource - update to 3.0.3-139
ruby-debuginfo - update to 3.0.3-139
ruby - update to 3.0.3-139
APEX Cloud Platform for Red Hat OpenShift - update to 03.01.02.00
rubygem-bigdecimal - update to 3.1.5-3
ruby3.2 (Ubuntu package) - update to 3.2.3-1ubuntu0.24.04.3
libruby3.2 (Ubuntu package) - update to 3.2.3-1ubuntu0.24.04.3
rubygem-rexml - update to 3.2.5-139
rubygems - update to 3.2.32-139
rubygems-devel - update to 3.2.32-139
rubygem-psych - update to 3.3.2-139
libruby3.3 (Ubuntu package) - update to 3.3.4-2ubuntu5.1
ruby3.3 (Ubuntu package) - update to 3.3.4-2ubuntu5.1
ruby-devel - update to 3.3.5-3
ruby-doc - update to 3.3.5-3
ruby-default-gems - update to 3.3.5-3
ruby - update to 3.3.5-3
ruby-bundled-gems - update to 3.3.5-3
ruby-libs - update to 3.3.5-3
rubygem-rexml - update to 3.3.6-3
rubygem-test-unit - update to 3.3.7-139
dev-ruby/rexml - update to 3.3.9
rubygem-rbs - update to 3.4.0-3
rubygems-devel - update to 3.5.16-3
rubygems - update to 3.5.16-3
rubygem-test-unit - update to 3.6.1-3
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.6, 5.0.1
Watson CP4D Data Stores - update to 5.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
rubygem-psych - update to 5.1.2-3
rubygem-minitest - update to 5.14.2-139
rubygem-minitest - update to 5.20.0-3
rubygem-rdoc - update to 6.3.3-139
rubygem-rdoc - update to 6.6.3.1-3
rubygem-rake - update to 13.0.3-139
rubygem-rake - update to 13.1.0-3

• https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/

• Remote denial of service in REXML gem
• Input validation error in IBM Watson Discovery for IBM Cloud Pak for Data
• openEuler update for ruby
• Multiple vulnerabilities in IBM License Metric Tool
• Red Hat Enterprise Linux 8 update for the ruby:3.3 module
• Red Hat Enterprise Linux 9 update for the ruby:3.3 module
• Multiple vulnerabilities in Oracle Linux
• SUSE update for ruby2.5
• Ubuntu update for ruby3.0
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android)
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS)
• Ubuntu update for ruby2.7
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• IBM watsonx Assistant for IBM Cloud Pak for Data update for Ruby REXML
• Multiple vulnerabilities in IBM Watson CP4D Data Stores
• Ubuntu update for ruby2.7
• Multiple vulnerabilities in IBM Software Support app
• Anolis OS update for ruby:3.3 module
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in Dell VxRail Appliance 7.x
• APEX Cloud Platform for Microsoft Azure update for third-party components
• Red Hat Enterprise Linux 9 update for the ruby:3.1 module
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift
• Gentoo update for REXML
• Ubuntu update for ruby2.3