发布时间: 2024年7月12日
修改时间: 2024年10月8日
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don t parse untrusted XMLs.
| NVD | openEuler | |
|---|---|---|
| CVSS评分 | 5.3 | 5.3 |
| Attack Vector | Network | Network |
| Attack Complexity | Low | Low |
| Privileges Required | None | None |
| User Interaction | None | None |
| Scope | Unchanged | Unchanged |
| Confidentiality | None | None |
| Integrity | None | None |
| Availability | Low | Low |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2024-3655 | ruby security update | 2024年7月12日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-5A | ruby | Fixed |
| KY3.5.2 | ruby | Fixed |
| V6 | ruby | Fixed |
