diff --git a/bundle-audit-time.txt b/bundle-audit-time.txt index a0feced..1a9524b 100644 --- a/bundle-audit-time.txt +++ b/bundle-audit-time.txt @@ -1 +1 @@ -2024-10-29T08:02:56+01:00 +2024-10-29T08:03:58+01:00 diff --git a/bundle-audit.json b/bundle-audit.json index 1d068cf..4083c29 100644 --- a/bundle-audit.json +++ b/bundle-audit.json @@ -1 +1 @@ -{"version":"0.9.2","created_at":"2024-10-29 08:02:56 +0100","results":[{"type":"unpatched_gem","gem":{"name":"rexml","version":"3.3.7"},"advisory":{"path":"/home/wiseadvice/.local/share/ruby-advisory-db/gems/rexml/CVE-2024-49761.yml","id":"CVE-2024-49761","url":"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m","title":"REXML ReDoS vulnerability","date":"2024-10-28","description":"## Impact\n\nThe REXML gem before 3.3.9 has a ReDoS vulnerability when it\nparses an XML that has many digits between `&#` and `x...;`\nin a hex numeric character reference (`&#x...;`).\n\nThis does not happen with Ruby 3.2 or later. Ruby 3.1 is the only\naffected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.\n\n## Patches\n\nThe REXML gem 3.3.9 or later include the patch to fix the vulnerability.\n\n## Workarounds\n\nUse Ruby 3.2 or later instead of Ruby 3.1.\n\n## References\n\n* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761\n * Announced on www.ruby-lang.org.\n","cvss_v2":null,"cvss_v3":null,"cve":"2024-49761","osvdb":null,"ghsa":"2rxp-v6pw-ch6m","unaffected_versions":[],"patched_versions":[">= 3.3.9"],"criticality":null}}]} \ No newline at end of file +{"version":"0.9.2","created_at":"2024-10-29 08:03:58 +0100","results":[]} \ No newline at end of file diff --git a/report.txt b/report.txt index a8a3184..8900c02 100644 --- a/report.txt +++ b/report.txt @@ -1,10 +1 @@ -Name: rexml -Version: 3.3.7 -CVE: CVE-2024-49761 -GHSA: GHSA-2rxp-v6pw-ch6m -Criticality: Unknown -URL: https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m -Title: REXML ReDoS vulnerability -Solution: update to '>= 3.3.9' - -Vulnerabilities found! +No vulnerabilities found diff --git a/update-info.txt b/update-info.txt index 8f00631..32dbff5 100644 --- a/update-info.txt +++ b/update-info.txt @@ -1,11 +1,5 @@ Updating ruby-advisory-db ... -Updating c105c3f..8c2227f -Fast-forward - gems/mpxj/CVE-2024-49771.yml | 35 +++++++++++++++++++++++++++++++++++ - gems/rexml/CVE-2024-49761.yml | 40 ++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 75 insertions(+) - create mode 100644 gems/mpxj/CVE-2024-49771.yml - create mode 100644 gems/rexml/CVE-2024-49761.yml +Already up to date. Updated ruby-advisory-db ruby-advisory-db: advisories: 945 advisories