CVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrec...
Original description
The description as published by the source.
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
ruby-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.7"},{"introduced":"2.7.0"},{"fixed":"2.7.3"},{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}]
Bitnami
ruby
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.7"},{"introduced":"2.7.0"},{"fixed":"2.7.3"},{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-28965 ruby Fixed in: 2.5.9-r0
- Debian DEBIAN-CVE-2021-28965 ruby2.7 Fixed in: 2.7.3-1
References
- advisory security.netapp.com
- advisory ruby-lang.org
- web lists.fedoraproject.org
- web nvd.nist.gov