Vulnerability · Published Oct 28, 2024 · Assigned by GitHub_M
CVE-2024-49761REXML ReDoS vulnerability
Medium 6.6
In plain English
A medium-severity regular-expression denial of service in rexml from ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.6Medium
Exploit odds (30 days)1.4%top 27.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10.6.alma.1 | ALSA-2025:11047 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10.6.alma.1 | ALSA-2025:11047 |
| AlmaLinux:8 | ruby | 3.1.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | ruby | 2.5.9-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | ruby | 3.1.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | ruby | 3.0.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | ruby-bundled-gems | 3.1.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | ruby-bundled-gems | 3.1.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | ruby-default-gems | 3.1.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | ruby-default-gems | 3.0.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | ruby-default-gems | 3.1.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | ruby-devel | 3.1.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | ruby-devel | 2.5.9-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | ruby-devel | 3.1.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | ruby-devel | 3.0.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | ruby-doc | 2.5.9-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | ruby-doc | 3.1.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | ruby-doc | 3.0.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | ruby-doc | 3.1.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | ruby-irb | 2.5.9-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | ruby-libs | 2.5.9-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | ruby-libs | 3.1.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | ruby-libs | 3.1.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | ruby-libs | 3.0.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.9.0+3746+91b8233a | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3854+02eaa59a | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+2623+08a8ba32 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-bigdecimal | 1.3.4-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.1-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-bigdecimal | 3.0.0-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-bigdecimal | 3.1.1-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.5.0+259+8cec6917 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.6.0+3170+4b08f9d4 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-bundler | 2.3.27-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-bundler | 1.16.1-4.module_el8.10.0+3871+342e2c2f | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-bundler | 2.3.27-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-bundler | 2.2.33-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-bundler-doc | 1.16.1-4.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-did_you_mean | 1.2.0-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-io-console | 0.5.11-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-io-console | 0.4.6-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-io-console | 0.5.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-io-console | 0.5.11-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-irb | 1.4.1-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-irb | 1.4.1-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-irb | 1.3.5-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-json | 2.6.1-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-json | 2.1.0-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-json | 2.6.1-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-json | 2.5.1-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-minitest | 5.10.3-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-minitest | 5.15.0-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-minitest | 5.14.2-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-minitest | 5.15.0-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.3-3.module_el8.9.0+3746+91b8233a | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.6.0+3170+4b08f9d4 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+259+8cec6917 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.3-3.module_el8.10.0+3854+02eaa59a | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.3-3.module_el8.10.0+3854+02eaa59a | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-net-telnet | 0.1.1-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-openssl | 2.1.2-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-pg | 1.3.2-1.module_el8.10.0+3854+02eaa59a | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-pg | 1.3.2-1.module_el8.9.0+3746+91b8233a | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-pg | 1.0.0-3.module_el8.9.0+3635+c6f99506 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-pg | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-pg-doc | 1.3.2-1.module_el8.10.0+3854+02eaa59a | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-pg-doc | 1.0.0-3.module_el8.9.0+3635+c6f99506 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-pg-doc | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-power_assert | 1.1.1-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.1-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-power_assert | 2.0.1-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-power_assert | 1.2.1-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-psych | 3.0.2-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygem-psych | 4.0.4-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-psych | 3.3.2-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-psych | 4.0.4-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-rake | 13.0.6-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-rake | 12.3.3-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-rake | 13.0.3-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-rake | 13.0.6-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-rbs | 2.7.0-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-rbs | 2.7.0-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-rbs | 1.4.0-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-rdoc | 6.4.1.1-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-rdoc | 6.0.1.1-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-rdoc | 6.4.1.1-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-rdoc | 6.3.4.1-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-rexml | 3.2.5-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-rexml | 3.2.5-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-rexml | 3.2.5-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-rss | 0.2.9-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-rss | 0.2.9-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-rss | 0.2.9-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-test-unit | 3.5.3-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygem-test-unit | 3.2.7-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygem-test-unit | 3.5.3-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygem-test-unit | 3.3.7-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.3-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygem-typeprof | 0.15.2-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:9 | rubygem-typeprof | 0.21.3-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:8 | rubygem-xmlrpc | 0.3.0-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygems | 3.3.27-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:8 | rubygems | 2.7.6.3-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:9 | rubygems | 3.3.27-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygems | 3.2.33-163.el9_5 | ALSA-2024:10858 |
| AlmaLinux:8 | rubygems-devel | 2.7.6.3-113.module_el8.10.0+3932+2d440da3 | ALSA-2024:10850 |
| AlmaLinux:8 | rubygems-devel | 3.3.27-144.module_el8.10.0+3933+43481280 | ALSA-2024:10834 |
| AlmaLinux:9 | rubygems-devel | 3.3.27-145.module_el9.5.0+129+9ba7e8b1 | ALSA-2024:10860 |
| AlmaLinux:9 | rubygems-devel | 3.2.33-163.el9_5 | ALSA-2024:10858 |
| Alpine:v3.20 | ruby-rexml | 3.3.9-r0 | ALPINE-CVE-2024-49761 |
| Alpine:v3.21 | ruby-rexml | 3.3.9-r0 | ALPINE-CVE-2024-49761 |
| Alpine:v3.22 | ruby-rexml | 3.3.9-r0 | ALPINE-CVE-2024-49761 |
| Alpine:v3.23 | ruby-rexml | 3.3.9-r0 | ALPINE-CVE-2024-49761 |
| Alpine:v3.24 | ruby-rexml | 3.3.9-r0 | ALPINE-CVE-2024-49761 |
| Debian:12 | ruby3.1 | no fix listed | DEBIAN-CVE-2024-49761 |
| Debian:13 | ruby3.3 | 3.3.6-1 | DEBIAN-CVE-2024-49761 |
| Debian:14 | ruby3.3 | 3.3.6-1 | DEBIAN-CVE-2024-49761 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10.6 | RLSA-2025:11047 |
| Rocky Linux:8 | ruby | 0:3.1.5-144.module+el8.10.0+1903+95c5d658 | RLSA-2024:10834 |
| Rocky Linux:8 | ruby | 0:2.5.9-113.module+el8.10.0+1901+b9cac91a | RLSA-2024:10850 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1679+61871737 | RLSA-2024:10834 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 | RLSA-2024:10850 |
| Rocky Linux:8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+1536+5f79634e | RLSA-2024:10850 |
| Rocky Linux:8 | rubygem-bundler | 0:1.16.1-4.module+el8.9.0+1536+5f79634e | RLSA-2024:10850 |
| Rocky Linux:8 | rubygem-mongo | 0:2.5.1-2.module+el8.9.0+1536+5f79634e | RLSA-2024:10850 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+1536+5f79634e | RLSA-2024:10850 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.3-3.module+el8.10.0+1744+6c504228 | RLSA-2024:10834 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.4-1.module+el9.6.0+31865+0893c253 | RLSA-2024:10860 |
| Rocky Linux:8 | rubygem-pg | 0:1.3.2-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2024:10834 |
| Rocky Linux:8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+1536+5f79634e | RLSA-2024:10850 |
| Rocky Linux:9 | rubygem-pg | 0:1.3.5-1.module+el9.6.0+31865+0893c253 | RLSA-2024:10860 |
| RubyGems | rexml | 3.3.9 | GHSA-2rxp-v6pw-ch6m |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.8 | USN-7091-1 |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.8 | UBUNTU-CVE-2024-49761 |
| Ubuntu:24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.3 | UBUNTU-CVE-2024-49761 |
| Ubuntu:24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.3 | USN-7091-1 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
References
- https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m x_refsource_CONFIRM
- https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f x_refsource_MISC
- https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20241227-0004/
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html