diff --git a/en/news/_posts/2024-08-01-dos-rexml-cve-2024-41123.md b/en/news/_posts/2024-08-01-dos-rexml-cve-2024-41123.md new file mode 100644 index 0000000000..d4d5e49bd9 --- /dev/null +++ b/en/news/_posts/2024-08-01-dos-rexml-cve-2024-41123.md @@ -0,0 +1,29 @@ +--- +layout: news_post +title: "CVE-2024-41123: DoS vulnerabilities in REXML" +author: "kou" +translator: +date: 2024-08-01 03:00:00 +0000 +tags: security +lang: en +--- + +There are some DoS vulnerabilities in REXML gem. These vulnerabilities have been assigned the CVE identifier [CVE-2024-41123](https://www.cve.org/CVERecord?id=CVE-2024-41123). We strongly recommend upgrading the REXML gem. + +## Details + +When parsing an XML document that has many specific characters such as whitespace character, `>]` and `]>`, REXML gem may take long time. + +Please update REXML gem to version 3.3.3 or later. + +## Affected versions + +* REXML gem 3.3.2 or prior + +## Credits + +Thanks to [mprogrammer](https://hackerone.com/mprogrammer) and [scyoon](https://hackerone.com/scyoon) for discovering these issues. + +## History + +* Originally published at 2024-08-01 03:00:00 (UTC)