REXML Regular Expression Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the REXML library, used in various components of Red Hat Satellite. This vulnerability arises from inefficient regular expression parsing of hex numeric character references in XML documents, allowing remote attackers to cause a regular expression denial-of-service (ReDoS) attack. The issue impacts the availability of the affected component and stems from an incomplete fix for a previous vulnerability (CVE-2024-49761).

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing resource consumption on the affected system by degrading performance and responsiveness.

Remediation

Users can upgrade to the patched versions of Red Hat Satellite 6.16 or 6.17 for RHEL 8 and 9. Instructions for applying this update are available in the Red Hat Satellite 6.17 Updating Guide.