Source: ruby3.3 Version: 3.3.8-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for ruby3.3. CVE-2025-58767[0]: | REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 | has a DoS vulnerability when parsing XML containing multiple XML | declarations. If you need to parse untrusted XMLs, you may be | impacted to these vulnerabilities. The REXML gem 3.4.2 or later | include the patches to fix these vulnerabilities. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-58767 https://www.cve.org/CVERecord?id=CVE-2025-58767 [1] https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ [2] https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5 [3] https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23 Regards, Salvatore
