CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
23.8%
A vulnerability was found in REXML, an XML toolkit used for Ruby. When parsing an untrusted XML with many specific characters, the REXML gem may take a long time, leading to a denial of service condition. Some of these special characters include the whitespace character, ‘>]’, and ‘]>’.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. It is recommended to upgrade the REXML gem to fix these vulnerabilities.
bugzilla.redhat.com/show_bug.cgi?id=2302268
github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6
github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
nvd.nist.gov/vuln/detail/CVE-2024-41123
www.cve.org/CVERecord?id=CVE-2024-41123
www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
23.8%