HCE2-SA-2024-0259 Moderate HCE 2.0 Security Fix(es): REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don_x27;t parse untrusted XMLs. (CVE-2024-35176) Rubygems.org is the Ruby community_x27;s gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab. (CVE-2024-35221) HCE 2.0 rubygems-3.2.32-122.r13.hce2.noarch.rpm rubygems-devel-3.2.32-122.r13.hce2.noarch.rpm rubygem-bigdecimal-3.0.0-122.r13.hce2.aarch64.rpm rubygem-did_you_mean-1.5.0-122.r13.hce2.noarch.rpm rubygem-io-console-0.5.7-122.r13.hce2.aarch64.rpm rubygem-json-2.5.1-122.r13.hce2.aarch64.rpm rubygem-minitest-5.14.2-122.r13.hce2.noarch.rpm rubygem-openssl-2.2.1-122.r13.hce2.aarch64.rpm rubygem-power_assert-1.2.0-122.r13.hce2.noarch.rpm rubygem-psych-3.3.2-122.r13.hce2.aarch64.rpm rubygem-rake-13.0.3-122.r13.hce2.noarch.rpm rubygem-rbs-1.4.0-122.r13.hce2.noarch.rpm rubygem-rdoc-6.3.3-122.r13.hce2.noarch.rpm rubygem-rexml-3.2.5-122.r13.hce2.noarch.rpm rubygem-rss-0.2.9-122.r13.hce2.noarch.rpm rubygem-test-unit-3.3.7-122.r13.hce2.noarch.rpm rubygem-typeprof-0.15.2-122.r13.hce2.noarch.rpm ruby-3.0.3-122.r13.hce2.aarch64.rpm ruby-devel-3.0.3-122.r13.hce2.aarch64.rpm ruby-help-3.0.3-122.r13.hce2.noarch.rpm ruby-irb-3.0.3-122.r13.hce2.noarch.rpm rubygem-bigdecimal-3.0.0-122.r13.hce2.x86_64.rpm rubygem-io-console-0.5.7-122.r13.hce2.x86_64.rpm rubygem-json-2.5.1-122.r13.hce2.x86_64.rpm rubygem-openssl-2.2.1-122.r13.hce2.x86_64.rpm rubygem-psych-3.3.2-122.r13.hce2.x86_64.rpm ruby-3.0.3-122.r13.hce2.x86_64.rpm ruby-devel-3.0.3-122.r13.hce2.x86_64.rpm