Upgrade REXML gem to 3.3.6 to fix DoS vulnerability (CVE-2024-43398)

[yuzhongqi]

Description

Summary The REXML gem versions prior to 3.3.6 contain a Denial of Service (DoS) vulnerability when parsing deeply nested XML documents that have elements with the same local name attributes.

Impact Applications using REXML::Document.new (tree parser API) to parse untrusted XML input may consume excessive memory and CPU, potentially leading to application hangs or crashes. Projects that only use the stream or SAX2 parser APIs are not affected.

Affected Component /output/SourcePackages/checkouts/DeviceKit/Gemfile.lock Detected version: rexml 3.2.5

Fix / Recommendation Upgrade the rexml gem to version 3.3.6 or later to include the official patch.

Workaround If immediate upgrade is not possible, avoid parsing untrusted XML data using the tree parser API (REXML::Document.new).

References Ruby security advisory: https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/