PT-2021-5813 · Ruby+9 · Rexml+10
Juho Nurminen
·
Published
2021-04-12
·
Updated
2025-12-12
·
CVE-2021-28965
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
REXML gem versions prior to 3.2.5 in Ruby versions prior to 2.6.7
REXML gem versions prior to 3.2.5 in Ruby versions 2.7.x prior to 2.7.3
REXML gem versions prior to 3.2.5 in Ruby versions 3.x prior to 3.0.1
Description
The issue is related to the incorrect handling of XML round-trip issues in the REXML gem, which can lead to the production of an incorrect document after parsing and serializing. This can potentially allow a remote attacker to impact data integrity.
Recommendations
For Ruby versions prior to 2.6.7, update the REXML gem to version 3.2.5 or later.
For Ruby versions 2.7.x prior to 2.7.3, update the REXML gem to version 3.2.5 or later.
For Ruby versions 3.x prior to 3.0.1, update the REXML gem to version 3.2.5 or later.
Exploit
Fix
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Rexml
Red Hat
Rocky Linux
Ruby
Suse
Ubuntu