Spotted what might be an issue in Gemfile.lock around line 171.
Vulnerability: CVE-2024-49761 (HIGH) - The project locks the rexml gem at version 3.2.6 in Gemfile.lock (line 171), which is affected by a Regular Expression Denial of Service (ReDoS) vulnerability. When REXML parses XML containing a hex numeric character reference with an excessive number of digits (e.g., &#x...; with many digits between &# and ;), a regex in the parser suffers from catastrophic backtracking, causing excessive CPU consumption. An attacker who can supply malicious XML to any code path that parses it with REXML (e.g., ActiveSupport::XmlMini when Nokogiri is unavailable, or direct REXML usage) can exhaust CPU and cause a denial of service. Impact: unauthenticated denial of service if attacker-controlled XML reaches a REXML parser. Risk level: HIGH. Note: per the CVE, only Ruby 3.1 (and earlier) exhibits the crash behavior, so applications on Ruby >= 3.2 have reduced practical exposure — but upgrading is still strongly recommended as rexml < 3.3.9 remains flagged and vulnerable to the pathological parsing behavior. Remediation: upgrade to rexml >= 3.3.9.
Something like this might fix it:
Do not hand-edit Gemfile.lock. Update the gem via Bundler, and pin a safe floor in the Gemfile to prevent regressions:
1) Run:
bundle update rexml
2) Gemfile diff (add explicit constraint):
```diff
--- a/Gemfile
+++ b/Gemfile
@@
# Security: CVE-2024-49761 (ReDoS in hex numeric character reference parsing)
+gem "rexml", ">= 3.3.9"
```
3) Resulting Gemfile.lock change:
```diff
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@
- rexml (3.2.6)
+ rexml (3.3.9)
```
4) Verify after updating:
bundle exec gem list rexml # confirm >= 3.3.9
bundle audit check-update # re-scan to confirm the finding is resolved
If `rexml` is a transitive dependency of rails/activesupport, the explicit Gemfile entry plus `bundle update rexml` ensures the resolved version satisfies the >= 3.3.9 requirement. Also consider confirming the deployment Ruby version is >= 3.2, where the reported crash behavior does not occur.
For reference: rule CVE-2024-49761. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
Gemfile.lockaround line 171.Vulnerability: CVE-2024-49761 (HIGH) - The project locks the
rexmlgem at version 3.2.6 in Gemfile.lock (line 171), which is affected by a Regular Expression Denial of Service (ReDoS) vulnerability. When REXML parses XML containing a hex numeric character reference with an excessive number of digits (e.g.,&#x...;with many digits between&#and;), a regex in the parser suffers from catastrophic backtracking, causing excessive CPU consumption. An attacker who can supply malicious XML to any code path that parses it with REXML (e.g., ActiveSupport::XmlMini when Nokogiri is unavailable, or direct REXML usage) can exhaust CPU and cause a denial of service. Impact: unauthenticated denial of service if attacker-controlled XML reaches a REXML parser. Risk level: HIGH. Note: per the CVE, only Ruby 3.1 (and earlier) exhibits the crash behavior, so applications on Ruby >= 3.2 have reduced practical exposure — but upgrading is still strongly recommended as rexml < 3.3.9 remains flagged and vulnerable to the pathological parsing behavior. Remediation: upgrade to rexml >= 3.3.9.Something like this might fix it:
For reference: rule
CVE-2024-49761. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.