reedhhw/github-slideshow

CVE-2021-28965 (High) detected in rexml-3.2.4.gem

mend-bolt-for-github opened this issue · 2 comments

mend-bolt-for-github commented

CVE-2021-28965 - High Severity Vulnerability

Vulnerable Library - rexml-3.2.4.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.4.gem

Dependency Hierarchy:

  • github-pages-207.gem (Root Library)
    • jekyll-sitemap-1.4.0.gem
      • jekyll-3.9.0.gem
        • kramdown-2.3.0.gem
          • ❌ rexml-3.2.4.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Publish Date: 2021-04-21

URL: CVE-2021-28965

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cr8-4vfw-mr7h

Release Date: 2021-04-21

Fix Resolution: rexml - 3.1.9.1, 3.2.5

Step up your Open Source Security Game with Mend here

secure-code-warrior-for-github commented

Micro-Learning Topic: Vulnerable library (Detected by phrase)

What is this? (2min video)

Use of vulnerable components will introduce weaknesses into the application. Components with published vulnerabilities will allow easy exploitation as resources will often be available to automate the process.

Try this challenge in Secure Code Warrior

secure-code-warrior-for-github commented

Micro-Learning Topic: Vulnerable library (Detected by phrase)

Matched on "Vulnerable Library"

What is this? (2min video)

Use of vulnerable components will introduce weaknesses into the application. Components with published vulnerabilities will allow easy exploitation as resources will often be available to automate the process.

Try this challenge in Secure Code Warrior