Mageia alert MGASA-2025-0001 (ruby)
| From: | Mageia Updates <updates-announce@ml.mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2025-0001: Updated ruby packages fix security vulnerabilities | |
| Date: | Sat, 04 Jan 2025 22:10:09 +0100 | |
| Message-ID: | <20250104211009.551EFA0D6E@duvel.mageia.org> | |
| Archive-link: | Article |
MGASA-2025-0001 - Updated ruby packages fix security vulnerabilities Publication date: 04 Jan 2025 URL: https://advisories.mageia.org/MGASA-2025-0001.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-35176, CVE-2024-39908, CVE-2024-41123, CVE-2024-41946, CVE-2024-43398, CVE-2024-49761 Description: The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. (CVE-2024-35176) The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. (CVE-2024-39908) The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. (CVE-2024-41123) The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. (CVE-2024-41946) The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. (CVE-2024-43398) The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). (CVE-2024-49761) References: - https://bugs.mageia.org/show_bug.cgi?id=33576 - https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cv... - https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cv... - https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cv... - https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cv... - https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cv... - https://lists.fedoraproject.org/archives/list/package-ann... - https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-... - https://ubuntu.com/security/notices/USN-7091-1 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4... SRPMS: - 9/core/ruby-3.1.5-46.mga9