diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 98e485c04fae..3f67b5777052 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -78,6 +78,45 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + ruby -- XML round-trip vulnerability in REXML + + + ruby + 2.5.0,12.5.9,1 + 2.6.0,12.6.7,1 + 2.7.0,12.7.3,1 + 3.0.0.p1,13.0.1,1 + + + rubygem-rexml + 3.2.5 + + + + +

Juho Nurminen reports:

+
+ When parsing and serializing a crafted XML document, REXML gem + (including the one bundled with Ruby) can create a wrong XML + document whose structure is different from the original one. + The impact of this issue highly depends on context, but it may + lead to a vulnerability in some programs that are using REXML. +
+

+ + + + CVE-2021-28965 + https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/ + + + 2021-04-05 + 2021-04-05 + + + samba -- Multiple Vulnerabilities