Detections
Analytics
Alpine: multiple ruby-rexml packages: security update to 3.3.9-r0
high Tenable Self-Hosted Container Security Plugin ID 424420
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses
an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs,
you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix
these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing
untrusted XML strings. (CVE-2024-39908)
- REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses
an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3
or later include the patches to fix these vulnerabilities. (CVE-2024-41123)
- REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that
has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to
fix the vulnerability. (CVE-2024-41946)
- REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML
that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with
tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other
parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML
gem 3.3.6 or later include the patch to fix the vulnerability. (CVE-2024-43398)
- REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an
XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does
not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or
later include the patch to fix the vulnerability. (CVE-2024-49761)
See Also
https://security.alpinelinux.org/vuln/CVE-2024-39908
https://security.alpinelinux.org/vuln/CVE-2024-41123
https://security.alpinelinux.org/vuln/CVE-2024-41946
Plugin Details
Severity: High
ID: 424420
Version: Revision 1.108
Type: Local
Published: 4/4/2025
Updated: 7/1/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.69
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2024-49761
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 8.7
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 7/16/2024
Reference Information
CVE: CVE-2024-39908, CVE-2024-41123, CVE-2024-41946, CVE-2024-43398, CVE-2024-49761