CVE-2024-39908

Katalog CVE

CVSS 4.3 · Medium EPSS 1,5%

Kerentanan Uncontrolled Resource Consumption pada ruby-lang rexml, netapp bootstrap os. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.

Rincian

Terbit di NVD

16 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 advisory vendor
• https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908 advisory vendor
• https://security.netapp.com/advisory/ntap-20250117-0008/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html