CVE Vulnerabilities

CVE-2021-28965

Published: Apr 21, 2021 | Modified: Nov 07, 2023
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Affected Software

Name Vendor Start Version End Version
Rexml Ruby-lang * 3.2.5 (excluding)
Ruby Ruby-lang * 2.6.7 (excluding)
Ruby Ruby-lang 2.7.0 (including) 2.7.3 (excluding)
Ruby Ruby-lang 3.0.0 (including) 3.0.1 (excluding)
Red Hat Enterprise Linux 8 RedHat ruby:2.7-8040020210421133318.522a0ee4 *
Red Hat Enterprise Linux 8 RedHat ruby:2.5-8040020200923213910.522a0ee4 *
Red Hat Enterprise Linux 8 RedHat ruby:2.6-8040020210430142949.522a0ee4 *
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions RedHat ruby:2.6-8010020220201152941.c27ad7f8 *
Red Hat Enterprise Linux 8.2 Extended Update Support RedHat ruby:2.6-8020020220201131207.4cda2c84 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-ruby25-ruby-0:2.5.9-9.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-ruby27-ruby-0:2.7.3-129.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-ruby26-ruby-0:2.6.7-119.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-ruby25-ruby-0:2.5.9-9.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-ruby25-ruby-0:2.5.9-9.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-ruby27-ruby-0:2.7.3-129.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-ruby26-ruby-0:2.6.7-119.el7 *
Ruby-rexml Ubuntu groovy *
Ruby-rexml Ubuntu hirsute *
Ruby-rexml Ubuntu impish *
Ruby-rexml Ubuntu trusty *
Ruby-rexml Ubuntu upstream *
Ruby2.3 Ubuntu trusty *
Ruby2.3 Ubuntu xenial *
Ruby2.5 Ubuntu bionic *
Ruby2.5 Ubuntu trusty *
Ruby2.5 Ubuntu upstream *
Ruby2.7 Ubuntu focal *
Ruby2.7 Ubuntu groovy *
Ruby2.7 Ubuntu hirsute *
Ruby2.7 Ubuntu impish *
Ruby2.7 Ubuntu trusty *
Ruby2.7 Ubuntu upstream *

References