CVE-2024-35176 REXML contains a denial of service vulnerability
An attacker can cause a denial of service by providing XML with many less-than signs in attribute values to applications using the REXML library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35176?
CVE-2024-35176 is a medium-severity denial of service vulnerability in ruby rexml, published on 16 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
Which versions are affected by CVE-2024-35176?
2 open source packages ship an affected version, including rexml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rexml RubyGems | All versions | 3.2.7 |
rexml RubyGems | All versions | 3.2.7 |
Linux distribution packages (7)
pcs AlmaLinux:8 | All versions | 0.10.18-2.el8_10.1 |
pcs-snmp AlmaLinux:8 | All versions | 0.10.18-2.el8_10.1 |
pcs Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.18-2.el8_10.1 |
pcs-snmp Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.18-2.el8_10.1 |
pcs Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.18-2.el8_10.1 |
pcs-snmp Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.18-2.el8_10.1 |
pcs Rocky Linux:8 | All versions | 0:0.10.18-2.el8_10.1 |
Products include Ruby-Lang Rexml.
How do I fix CVE-2024-35176?
Upgrade rexml to 3.2.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-35176 being exploited?
There is no known exploitation of CVE-2024-35176 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in ruby rexml
Sources
Also known as ALSA-2024:5338, AZL-42052, AZL-42064, AZL-42070, AZL-42076, DEBIAN-CVE-2024-35176 and 7 more.