Vulnerabilities

 1 via 1 paths

Dependencies

 45

Source

 GitHub

Commit

 2a6152f8

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

Uncontrolled Resource Consumption

  • Vulnerable module: rexml
  • Introduced through: webmock@3.14.0

Detailed paths

  • Introduced through: tomharvey/pwinty3-rb:Gemfile.lock@tomharvey/pwinty3-rb#2a6152f8b6fd98bc09a6b29007a62797b54ee655 › webmock@3.14.0 › crack@0.4.5 › rexml@3.2.5
    Remediation: Upgrade to webmock@3.14.0.

Overview

rexml is an An XML toolkit for Ruby.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption when parsing an XML that has many <s in an attribute value. An attacker can cause a denial of service by exploiting this behavior.

Workaround

This vulnerability can be mitigated by not parsing untrusted XMLs.

Remediation

Upgrade rexml to version 3.2.7 or higher.

References

Uncontrolled Resource Consumption vulnerability report