rpm package
almalinux/rubygem-rexml
pkg:rpm/almalinux/rubygem-rexml
Vulnerabilities (33)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-41123 | Med | 5.3 | < 3.3.6-3.module_el8.10.0+3894+6d587c81 | 3.3.6-3.module_el8.10.0+3894+6d587c81 | Aug 1, 2024 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. | |
| CVE-2024-39908 | Med | 4.3 | < 3.3.6-3.module_el8.10.0+3894+6d587c81 | 3.3.6-3.module_el8.10.0+3894+6d587c81 | Jul 16, 2024 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or | |
| CVE-2024-27282 | Med | 6.6 | < 3.2.5-143.module_el8.10.0+3852+ce828b19 | 3.2.5-143.module_el8.10.0+3852+ce828b19 | May 14, 2024 | An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2 | |
| CVE-2024-27281 | Med | 4.5 | < 3.2.5-143.module_el8.10.0+3852+ce828b19 | 3.2.5-143.module_el8.10.0+3852+ce828b19 | May 14, 2024 | An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the cl | |
| CVE-2024-27280 | Cri | 9.8 | < 3.2.5-143.module_el8.10.0+3852+ce828b19 | 3.2.5-143.module_el8.10.0+3852+ce828b19 | May 14, 2024 | A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0. | |
| CVE-2023-36617 | Med | 5.3 | < 3.2.5-142.module_el8.9.0+3746+91b8233a | 3.2.5-142.module_el8.9.0+3746+91b8233a | Jun 29, 2023 | A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue | |
| CVE-2023-28756 | Med | 5.3 | < 3.2.5-142.module_el8.9.0+3746+91b8233a | 3.2.5-142.module_el8.9.0+3746+91b8233a | Mar 31, 2023 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. | |
| CVE-2023-28755 | Med | 5.3 | < 3.2.5-142.module_el8.9.0+3746+91b8233a | 3.2.5-142.module_el8.9.0+3746+91b8233a | Mar 31, 2023 | A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 | |
| CVE-2021-33621 | Hig | 8.8 | < 3.2.5-142.module_el8.9.0+3746+91b8233a | 3.2.5-142.module_el8.9.0+3746+91b8233a | Nov 18, 2022 | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. | |
| CVE-2022-28739 | Hig | 7.5 | < 3.2.5-141.module_el8.6.0+3263+41cde0c0 | 3.2.5-141.module_el8.6.0+3263+41cde0c0 | May 9, 2022 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. | |
| CVE-2022-28738 | Cri | 9.8 | < 3.2.5-141.module_el8.6.0+3263+41cde0c0 | 3.2.5-141.module_el8.6.0+3263+41cde0c0 | May 9, 2022 | A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations. | |
| CVE-2021-41819 | Hig | 7.5 | < 3.2.5-141.module_el8.6.0+3263+41cde0c0 | 3.2.5-141.module_el8.6.0+3263+41cde0c0 | Jan 1, 2022 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. | |
| CVE-2021-41817 | Hig | 7.5 | < 3.2.5-141.module_el8.6.0+3263+41cde0c0 | 3.2.5-141.module_el8.6.0+3263+41cde0c0 | Jan 1, 2022 | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. |
- affected < 3.3.6-3.module_el8.10.0+3894+6d587c81fixed 3.3.6-3.module_el8.10.0+3894+6d587c81
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
- affected < 3.3.6-3.module_el8.10.0+3894+6d587c81fixed 3.3.6-3.module_el8.10.0+3894+6d587c81
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or
- affected < 3.2.5-143.module_el8.10.0+3852+ce828b19fixed 3.2.5-143.module_el8.10.0+3852+ce828b19
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2
- affected < 3.2.5-143.module_el8.10.0+3852+ce828b19fixed 3.2.5-143.module_el8.10.0+3852+ce828b19
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the cl
- affected < 3.2.5-143.module_el8.10.0+3852+ce828b19fixed 3.2.5-143.module_el8.10.0+3852+ce828b19
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.
- affected < 3.2.5-142.module_el8.9.0+3746+91b8233afixed 3.2.5-142.module_el8.9.0+3746+91b8233a
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue
- affected < 3.2.5-142.module_el8.9.0+3746+91b8233afixed 3.2.5-142.module_el8.9.0+3746+91b8233a
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
- affected < 3.2.5-142.module_el8.9.0+3746+91b8233afixed 3.2.5-142.module_el8.9.0+3746+91b8233a
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2
- affected < 3.2.5-142.module_el8.9.0+3746+91b8233afixed 3.2.5-142.module_el8.9.0+3746+91b8233a
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
- affected < 3.2.5-141.module_el8.6.0+3263+41cde0c0fixed 3.2.5-141.module_el8.6.0+3263+41cde0c0
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
- affected < 3.2.5-141.module_el8.6.0+3263+41cde0c0fixed 3.2.5-141.module_el8.6.0+3263+41cde0c0
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
- affected < 3.2.5-141.module_el8.6.0+3263+41cde0c0fixed 3.2.5-141.module_el8.6.0+3263+41cde0c0
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- affected < 3.2.5-141.module_el8.6.0+3263+41cde0c0fixed 3.2.5-141.module_el8.6.0+3263+41cde0c0
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
Page 2 of 2