{"action":"Upgrade rexml to 3.2.5 or later.","affected":[{"fixed":"3.2.5","introduced":"0"}],"component":"rexml","cve_ids":["CVE-2021-28965"],"ecosystem":"RubyGems","epss":0.05061,"exploited":false,"fixed_versions":["3.2.5"],"ghsa_id":"GHSA-8cr8-4vfw-mr7h","id":"tcs_01M5KEJ0NK9X1RGBK9CG3SC3D1","modified_at":"2025-01-27T08:58:46.059744Z","published_at":"2021-04-30T17:30:37Z","references":["https://osv.dev/vulnerability/GHSA-8cr8-4vfw-mr7h","https://nvd.nist.gov/vuln/detail/CVE-2021-28965","https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b","https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377","https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752","https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e","https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8","https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551","https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618","https://hackerone.com/reports/1104077","https://github.com/ruby/rexml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT","https://rubygems.org/gems/rexml","https://security.netapp.com/advisory/ntap-20210528-0003","https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-8cr8-4vfw-mr7h","url":"https://osv.dev/vulnerability/GHSA-8cr8-4vfw-mr7h"}],"summary":"REXML round-trip instability"}