CVE-2021-28965 REXML round-trip instability
An attacker can cause data corruption by exploiting improper XML round-trip handling in the REXML library, leading to incorrect document serialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28965?
CVE-2021-28965 is a high-severity vulnerability in Fedoraproject Fedora, published on 21 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Which versions are affected by CVE-2021-28965?
4 open source packages ship an affected version, including rexml, ruby and ruby-min. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
rexml RubyGems | All versions | 3.2.5 |
rexml RubyGems | All versions | 3.2.5 |
ruby Bitnami | All versions | 2.6.7, 2.7.3, 3.0.1 |
ruby-min Bitnami | All versions | 2.6.7, 2.7.3, 3.0.1 |
Linux distribution packages (3)
ruby2.5 SUSE:Linux Enterprise Micro 5.0 | All versions | 2.5.9-4.17.1 |
ruby2.5 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.5.9-4.17.1 |
ruby2.5 openSUSE:Leap 15.2 | All versions | 2.5.9-lp152.2.6.1 |
Products include Fedoraproject Fedora, Ruby-Lang Rexml, Ruby-Lang Ruby.
How do I fix CVE-2021-28965?
Upgrade rexml to 3.2.5 or later.
Is CVE-2021-28965 being exploited?
There is no known exploitation of CVE-2021-28965 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2021-28965, AZL-6860, BIT-ruby-2021-28965, BIT-ruby-min-2021-28965, CLEANSTART-2026-BM82320, DEBIAN-CVE-2021-28965 and 7 more.