Lucene search
FreeBSDDEC7E4B6-961A-11EB-9C34-080027F515EAHistoryApr 05, 2021 - 12:00 a.m.
ruby -- XML round-trip vulnerability in REXML
2021-04-0500:00:00
vuxml.freebsd.org
30
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
43.1%
Juho Nurminen reports:
When parsing and serializing a crafted XML document, REXML gem
(including the one bundled with Ruby) can create a wrong XML
document whose structure is different from the original one.
The impact of this issue highly depends on context, but it may
lead to a vulnerability in some programs that are using REXML.
Related
nessus
nessus
FreeBSD : Gitlab -- Vulnerabilities (fb6e53ae-9df6-11eb-ba8c-001b217b3468)
2021-04-16 00:00:00
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Ruby vulnerability (USN-4922-1)
2021-04-20 00:00:00
Amazon Linux AMI : ruby24 (ALAS-2021-1501)
2021-05-20 00:00:00
cloudfoundry
cloudfoundry
USN-4922-1: Ruby vulnerability | Cloud Foundry
2021-04-29 00:00:00
cbl_mariner
cbl_mariner
CVE-2021-28965 affecting package ruby 2.6.6-4
2021-06-09 03:50:37
CVE-2021-28965 affecting package ruby for versions less than 2.7.4-1
2022-04-09 06:51:53
openvas
openvas
Fedora: Security Advisory for rubygem-yard (FEDORA-2021-7b8b65bc7a)
2021-04-25 00:00:00
openSUSE: Security Advisory for ruby2.5 (openSUSE-SU-2021:0607-1)
2021-04-25 00:00:00
Fedora: Security Advisory for rubygem-pry (FEDORA-2021-7b8b65bc7a)
2021-04-25 00:00:00
ubuntu
ubuntu
Ruby vulnerability
2021-04-26 00:00:00
Ruby vulnerability
2021-04-20 00:00:00
redhatcve
redhatcve
CVE-2021-28965
2021-04-08 17:16:00
fedora
fedora
[SECURITY] Fedora 33 Update: ruby-2.7.3-136.fc33
2021-04-17 14:06:37
[SECURITY] Fedora 34 Update: rubygem-railties-6.1.2.1-2.fc34
2021-04-24 20:20:14
[SECURITY] Fedora 32 Update: ruby-2.7.3-136.fc32
2021-04-17 14:21:01
prion
prion
Code injection
2021-04-21 07:15:00
ubuntucve
ubuntucve
CVE-2021-28965
2021-04-12 00:00:00
hackerone
hackerone
Ruby: Round-trip instability in REXML
2021-02-16 08:10:08
freebsd
freebsd
Gitlab -- Vulnerabilities
2021-04-14 00:00:00
osv
osv
BIT-ruby-2021-28965
2024-03-06 11:05:40
ruby2.3, ruby2.5, ruby2.7 vulnerability
2021-04-20 17:01:53
CVE-2021-28965
2021-04-21 07:15:07
veracode
veracode
XML Injection
2021-04-17 02:47:08
debiancve
debiancve
CVE-2021-28965
2021-04-21 07:15:07
nvd
nvd
CVE-2021-28965
2021-04-21 07:15:07
alpinelinux
alpinelinux
CVE-2021-28965
2021-04-21 07:15:07
github
github
REXML round-trip instability
2021-04-30 17:30:37
amazon
amazon
Medium: ruby24
2021-05-14 16:58:00
cve
cve
CVE-2021-28965
2021-04-21 07:15:07
suse
suse
Security update for ruby2.5 (moderate)
2021-04-24 00:00:00
cvelist
cvelist
CVE-2021-28965
2021-04-21 06:55:24
redhat
redhat
oraclelinux
oraclelinux
ruby:2.7 security, bug fix, and enhancement update
2021-07-07 00:00:00
ruby:2.5 security, bug fix, and enhancement update
2021-07-02 00:00:00
ruby:2.6 security, bug fix, and enhancement update
2021-07-07 00:00:00
almalinux
almalinux
Moderate: ruby:2.7 security, bug fix, and enhancement update
2021-06-29 13:57:50
Moderate: ruby:2.5 security, bug fix, and enhancement update
2021-06-29 13:58:20
Moderate: ruby:2.6 security, bug fix, and enhancement update
2021-06-29 13:58:40
archlinux
archlinux
[ASA-202104-1] gitlab: multiple issues
2021-04-29 00:00:00
rocky
rocky
ruby:2.7 security, bug fix, and enhancement update
2021-06-29 13:57:50
ruby:2.5 security, bug fix, and enhancement update
2021-06-29 13:58:20
ruby:2.6 security, bug fix, and enhancement update
2021-06-29 13:58:40
debian
debian
[SECURITY] [DSA 5066-1] ruby2.5 security update
2022-02-03 19:26:40
mageia
mageia
Updated ruby packages fix security vulnerability
2021-12-24 00:01:45
ibm
ibm
rosalinux
rosalinux
Advisory ROSA-SA-2021-1966
2021-07-02 18:06:34
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
43.1%
Related for DEC7E4B6-961A-11EB-9C34-080027F515EA