XML Entity Expansion in REXML - CVE-2024-41946

Vulnerability identifier: #VU95148

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-41946

CWE-ID: CWE-776

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when parsing XML with SAX2 or pull parser API. A remote attacker can pass specially crafted XML data to the application and perform a denial of service attack.

REXML
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
Ubuntu
openEuler
APEX Cloud Platform for Microsoft Azure
Software Support app (Android)
Software Support App (iOS)
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)
IBM Cloud Pak for Watson AIOps
Dell EMC VxRail Appliance
IBM License Metric Tool
rubygem-rss
rubygem-abrt
rubygem-abrt-doc
rubygem-mysql2
rubygem-mysql2-doc
rubygem-io-console
pcs (Red Hat package)
pcs
pcs-snmp
rubygem-typeprof
rubygem-rbs
rubygem-did_you_mean
rubygem-pg
rubygem-pg-doc
rubygem-racc
rubygem-irb
rubygem-power_assert
rubygem-openssl
rubygem-bundler
ruby2.3 (Ubuntu package)
rubygem-json
ruby2.5-debugsource
ruby2.5-devel
ruby2.5-debuginfo
ruby2.5-devel-extra
ruby2.5-stdlib
ruby2.5
libruby2_5-2_5-debuginfo
ruby2.5-stdlib-debuginfo
libruby2_5-2_5
ruby2.7 (Ubuntu package)
libruby2.7 (Ubuntu package)
rubygem-bigdecimal
ruby-debuginfo
ruby
ruby-debugsource
ruby-devel
ruby-help
ruby-irb
ruby3.2 (Ubuntu package)
libruby3.2 (Ubuntu package)
rubygem-rexml
rubygems-devel
rubygems
rubygem-psych
libruby3.3 (Ubuntu package)
ruby3.3 (Ubuntu package)
ruby-bundled-gems
ruby-libs
ruby-doc
ruby-default-gems
rubygem-test-unit
dev-ruby/rexml
rubygem-minitest
rubygem-rdoc
rubygem-rake
ruby3.0 (Ubuntu package)
libruby3.0 (Ubuntu package)
APEX Cloud Platform for Red Hat OpenShift

Install updates from vendor's website.

REXML - update to 3.3.3
APEX Cloud Platform for Microsoft Azure - update to 01.04.00.00
Software Support app (Android) - update to 2.0.0
Software Support App (iOS) - update to 2.0.0
Dell EMC VxRail Appliance - addressed in versions 7.0.533, 8.320
IBM License Metric Tool - update to 9.2.37
rubygem-rss - update to 0.2.9-137
rubygem-rss - update to 0.3.1-3
rubygem-abrt - update to 0.4.0-1
rubygem-abrt-doc - update to 0.4.0-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-io-console - update to 0.5.7-137
rubygem-io-console - update to 0.7.1-3
pcs (Red Hat package) - addressed in versions 0.10.12-6.el8_6.6, 0.10.15-4.el8_8.3, 0.10.18-2.el8_10.2
pcs - update to 0.10.18-2.0.1
pcs-snmp - update to 0.10.18-2.0.1
rubygem-typeprof - update to 0.15.2-137
rubygem-typeprof - update to 0.21.9-3
Cognos Analytics Mobile (Android) - update to 1.1.20
Cognos Analytics Mobile (iOS) - update to 1.1.20
rubygem-rbs - update to 1.4.0-137
rubygem-did_you_mean - update to 1.5.0-137
rubygem-pg - update to 1.5.4-1
rubygem-pg-doc - update to 1.5.4-1
rubygem-racc - update to 1.7.3-3
rubygem-irb - update to 1.13.1-3
rubygem-power_assert - update to 2.0.3-3
rubygem-openssl - update to 2.2.1-137
rubygem-bundler - update to 2.2.32-137
ruby2.3 (Ubuntu package) - addressed in versions 2.3.1-2~ubuntu16.04.16+esm11, 2.5.1-1ubuntu1.16+esm6, 2.7.0-5ubuntu1.18+esm3
rubygem-json - update to 2.5.1-137
ruby2.5-debugsource - update to 2.5.9-150000.4.32.1
ruby2.5-devel - update to 2.5.9-150000.4.32.1
ruby2.5-debuginfo - update to 2.5.9-150000.4.32.1
ruby2.5-devel-extra - update to 2.5.9-150000.4.32.1
ruby2.5-stdlib - update to 2.5.9-150000.4.32.1
ruby2.5 - update to 2.5.9-150000.4.32.1
libruby2_5-2_5-debuginfo - update to 2.5.9-150000.4.32.1
ruby2.5-stdlib-debuginfo - update to 2.5.9-150000.4.32.1
libruby2_5-2_5 - update to 2.5.9-150000.4.32.1
rubygem-bundler - update to 2.5.16-3
ruby2.7 (Ubuntu package) - update to 2.7.0-5ubuntu1.15
libruby2.7 (Ubuntu package) - update to 2.7.0-5ubuntu1.15
rubygem-json - update to 2.7.1-3
rubygem-bigdecimal - update to 3.0.0-137
ruby3.0 (Ubuntu package) - update to 3.0.2-7ubuntu2.8
libruby3.0 (Ubuntu package) - update to 3.0.2-7ubuntu2.8
ruby-debuginfo - update to 3.0.3-137
ruby - update to 3.0.3-137
ruby-debugsource - update to 3.0.3-137
ruby-devel - update to 3.0.3-137
ruby-help - update to 3.0.3-137
ruby-irb - update to 3.0.3-137
APEX Cloud Platform for Red Hat OpenShift - update to 03.01.02.00
rubygem-bigdecimal - update to 3.1.5-3
ruby3.2 (Ubuntu package) - update to 3.2.3-1ubuntu0.24.04.3
libruby3.2 (Ubuntu package) - update to 3.2.3-1ubuntu0.24.04.3
rubygem-rexml - update to 3.2.5-137
rubygems-devel - update to 3.2.32-137
rubygems - update to 3.2.32-137
rubygem-psych - update to 3.3.2-137
libruby3.3 (Ubuntu package) - update to 3.3.4-2ubuntu5.1
ruby3.3 (Ubuntu package) - update to 3.3.4-2ubuntu5.1
ruby-bundled-gems - update to 3.3.5-3
ruby - update to 3.3.5-3
ruby-devel - update to 3.3.5-3
ruby-libs - update to 3.3.5-3
ruby-doc - update to 3.3.5-3
ruby-default-gems - update to 3.3.5-3
rubygem-rexml - update to 3.3.6-3
rubygem-test-unit - update to 3.3.7-137
dev-ruby/rexml - update to 3.3.9
rubygem-rbs - update to 3.4.0-3
rubygems-devel - update to 3.5.16-3
rubygems - update to 3.5.16-3
rubygem-test-unit - update to 3.6.1-3
IBM Cloud Pak for Watson AIOps - update to 4.8.0
rubygem-psych - update to 5.1.2-3
rubygem-minitest - update to 5.14.2-137
rubygem-minitest - update to 5.20.0-3
rubygem-rdoc - update to 6.3.3-137
rubygem-rdoc - update to 6.6.3.1-3
rubygem-rake - update to 13.0.3-137
rubygem-rake - update to 13.1.0-3

• https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/

• Multiple vulnerabilities in REXML gem
• openEuler update for ruby
• Red Hat Enterprise Linux 8 update for pcs
• Red Hat Enterprise Linux 8 update for pcs
• Red Hat Enterprise Linux 8 update for pcs
• Multiple vulnerabilities in IBM License Metric Tool
• Red Hat Enterprise Linux 8 update for the ruby:3.3 module
• Red Hat Enterprise Linux 9 update for the ruby:3.3 module
• Multiple vulnerabilities in Oracle Linux
• SUSE update for ruby2.5
• Ubuntu update for ruby3.0
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android)
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS)
• Ubuntu update for ruby2.7
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Software Support app
• Anolis OS update for pcs
• Anolis OS update for ruby:3.3 module
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in Dell VxRail Appliance 7.x
• APEX Cloud Platform for Microsoft Azure update for third-party components
• Red Hat Enterprise Linux 9 update for the ruby:3.1 module
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift
• Gentoo update for REXML
• Ubuntu update for ruby2.3