*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-43398
### Vulnerable Library - rexml-3.3.3.gem
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
Path to dependency file: /web/Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.3.3.gem
Found in HEAD commit: ebc900c8807f6dfc3852a1d415f174960923331c
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-49761
### Vulnerable Library - rexml-3.3.3.gemAn XML toolkit for Ruby
Library home page: https://rubygems.org/gems/rexml-3.3.3.gem
Path to dependency file: /web/Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.3.3.gem
Dependency Hierarchy: - minima-2.5.1.gem (Root Library) - jekyll-seo-tag-2.8.0.gem - jekyll-3.9.5.gem - kramdown-2.4.0.gem - :x: **rexml-3.3.3.gem** (Vulnerable Library)
Found in HEAD commit: ebc900c8807f6dfc3852a1d415f174960923331c
Found in base branch: main
### Vulnerability DetailsREXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Publish Date: 2024-10-28
URL: CVE-2024-49761
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-49761
Release Date: 2024-10-28
Fix Resolution: rexml - 3.3.9
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-43398
### Vulnerable Library - rexml-3.3.3.gemAn XML toolkit for Ruby
Library home page: https://rubygems.org/gems/rexml-3.3.3.gem
Path to dependency file: /web/Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/3.2.0/cache/rexml-3.3.3.gem
Dependency Hierarchy: - minima-2.5.1.gem (Root Library) - jekyll-seo-tag-2.8.0.gem - jekyll-3.9.5.gem - kramdown-2.4.0.gem - :x: **rexml-3.3.3.gem** (Vulnerable Library)
Found in HEAD commit: ebc900c8807f6dfc3852a1d415f174960923331c
Found in base branch: main
### Vulnerability DetailsREXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
Publish Date: 2024-08-22
URL: CVE-2024-43398
### CVSS 3 Score Details (5.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
Release Date: 2024-08-22
Fix Resolution: rexml - 3.3.6
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)