ALT-PU-2022-2533-1
Closed vulnerabilities
Published: 2021-04-12
BDU:2022-00302
Уязвимость интерпретатора языка программирования Ruby, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю оказать воздействие на целостность данных
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
Published: 2021-04-21
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- FEDORA-2021-7b8b65bc7a
- FEDORA-2021-7b8b65bc7a
- https://security.netapp.com/advisory/ntap-20210528-0003/
- https://security.netapp.com/advisory/ntap-20210528-0003/
- https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/
- https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/