[DRE-maint] Bug#1115655: ruby3.3: CVE-2025-58767

[Salvatore Bonaccorso]

Source: ruby3.3
Version: 3.3.8-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for ruby3.3.

CVE-2025-58767[0]:
| REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1
| has a DoS vulnerability when parsing XML containing multiple XML
| declarations. If you need to parse untrusted XMLs, you may be
| impacted to these vulnerabilities. The REXML gem 3.4.2 or later
| include the patches to fix these vulnerabilities.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-58767
    https://www.cve.org/CVERecord?id=CVE-2025-58767
[1] https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/
[2] https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5
[3] https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23 

Regards,
Salvatore