Skip to content

Commit 4ef92f3

Browse files
authored
Upgrade the REXML gem (#460)
Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. References - GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability - https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/
1 parent 8377c5a commit 4ef92f3

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Gemfile.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -322,8 +322,8 @@ GEM
322322
actionpack (>= 5.2)
323323
railties (>= 5.2)
324324
retryable (3.0.5)
325-
rexml (3.2.8)
326-
strscan (>= 3.0.9)
325+
rexml (3.3.4)
326+
strscan
327327
rspec-core (3.12.2)
328328
rspec-support (~> 3.12.0)
329329
rspec-expectations (3.12.3)

0 commit comments

Comments
 (0)