High severity · published Oct 28, 2024
CVE-2024-49761
REXML is an XML toolkit for Ruby
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
Ontap Tools · Netapp
10 · source: NVD
RE
Rexml · Ruby-lang
before 3.3.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-49761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-49761
Patch
https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
Third Party Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
Vendor Advisory
https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241227-0004/
More from Ontap Tools
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
9.8
CVE-2024-52533
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character
9.8
CVE-2024-1351
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed
9.3
CVE-2024-28752
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take…