Skip to content

[Security] Bump rexml from 3.2.5 to 3.3.6

HIFIS Bot requested to merge dependabot-bundler-rexml-3.3.6 into master

Bumps rexml from 3.2.5 to 3.3.6. This update includes security fixes.

Vulnerabilities fixed

REXML contains a denial of service vulnerability

Impact

The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many <s in an attribute value.

If you need to parse untrusted XMLs, you may be impacted to this vulnerability.

Patches

The REXML gem 3.2.7 or later include the patch to fix this vulnerability.

Workarounds

Don't parse untrusted XMLs.

References

Patched versions: 3.2.7
Affected versions: < 3.2.7

REXML denial of service vulnerability

Impact

The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>.

If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

Patched versions: 3.3.2
Affected versions: < 3.3.2

REXML DoS vulnerability

Impact

The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>.

If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

Patched versions: 3.3.3
Affected versions: < 3.3.3

REXML DoS vulnerability

Impact

The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API.

If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability.

Patches

The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

Workarounds

Don't parse untrusted XMLs with SAX2 or pull parser API.

References

Patched versions: 3.3.3
Affected versions: < 3.3.3

REXML denial of service vulnerability

Impact

The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes.

If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected.

Patches

The REXML gem 3.3.6 or later include the patch to fix the vulnerability.

Workarounds

Don't parse untrusted XMLs with tree parser API.

Patched versions: 3.3.6
Affected versions: < 3.3.6

Release notes

Sourced from rexml's releases.

REXML 3.3.6 - 2024-08-22

Improvements

  • Removed duplicated entity expansions for performance.

    • GH-194
    • Patch by Viktor Ivarsson.

  • Improved namespace conflicted attribute check performance. It was too slow for deep elements.

    • Reported by l33thaxor.

Fixes

  • Fixed a bug that default entity expansions are counted for security check. Default entity expansions should not be counted because they don't have a security risk.

  • Fixed a parser bug that parameter entity references in internal subsets are expanded. It's not allowed in the XML specification.

  • Fixed a stream parser bug that user-defined entity references in text aren't expanded.

Thanks

  • Viktor Ivarsson

  • NAITOH Jun

  • l33thaxor

REXML 3.3.5 - 2024-08-12

Fixes

  • Fixed a bug that REXML::Security.entity_expansion_text_limit check has wrong text size calculation in SAX and pull parsers.
    • GH-193
    • GH-195
    • Reported by Viktor Ivarsson.
    • Patch by NAITOH Jun.

... (truncated)

Changelog

Sourced from rexml's changelog.

3.3.6 - 2024-08-22 {#version-3-3-6}

Improvements

  • Removed duplicated entity expansions for performance.

    • GH-194
    • Patch by Viktor Ivarsson.

  • Improved namespace conflicted attribute check performance. It was too slow for deep elements.

    • Reported by l33thaxor.

Fixes

  • Fixed a bug that default entity expansions are counted for security check. Default entity expansions should not be counted because they don't have a security risk.

  • Fixed a parser bug that parameter entity references in internal subsets are expanded. It's not allowed in the XML specification.

  • Fixed a stream parser bug that user-defined entity references in text aren't expanded.

Thanks

  • Viktor Ivarsson

  • NAITOH Jun

  • l33thaxor

3.3.5 - 2024-08-12 {#version-3-3-5}

Fixes

  • Fixed a bug that REXML::Security.entity_expansion_text_limit check has wrong text size calculation in SAX and pull parsers.
    • GH-193
    • GH-195
    • Reported by Viktor Ivarsson.
    • Patch by NAITOH Jun.

... (truncated)

Commits
  • 95871f3 Add 3.3.6 entry
  • 7cb5eae parser tree: improve namespace conflicted attribute check performance
  • 6109e01 Fix a bug that Stream parser doesn't expand the user-defined entity reference...
  • cb15858 parser: keep the current namespaces instead of stack of Set
  • 2b47b16 parser: move duplicated end tag check to BaseParser
  • 35e1681 test tree-parser: move common method to base class
  • 6e00a14 test: fix indent
  • df3a0cc test: fix indent
  • fdbffe7 Use loop instead of recursive call for Element#namespace
  • 6422fa3 Use loop instead of recursive call for Element#root
  • Additional commits viewable in compare view

Merge request reports

A HIFIS Service | Privacy | Imprint | Support | Documentation | Changelog