Updated advisory posts against rubysec/ruby-advisory-db@448d4a3

Author: jasnow

advisories/_posts/2024-07-16-CVE-2024-39908.md

@@ -0,0 +1,44 @@
+---
+layout: advisory
+title: 'CVE-2024-39908 (rexml): DoS in REXML'
+comments: false
+categories:
+- rexml
+advisory:
+  gem: rexml
+  cve: 2024-39908
+  url: https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
+  title: DoS in REXML
+  date: 2024-07-16
+  description: |
+    There is a DoS vulnerability in REXML gem. This vulnerability has
+    been assigned the CVE identifier CVE-2024-39908. We strongly
+    recommend upgrading the REXML gem.
+
+    ## Details
+
+    When it parses an XML that has many specific characters such as
+    <, 0 and %>. REXML gem may take long time.
+
+    Please update REXML gem to version 3.3.2 or later.
+
+    ## Affected versions
+
+    REXML gem 3.3.2 or prior
+
+    ## Credits
+
+    Thanks to mprogrammer for discovering this issue.
+
+    ## History
+
+    Originally published at 2024-07-16 03:00:00 (UTC)
+  patched_versions:
+  - ">= 3.3.2"
+  related:
+    ghsa:
+    - https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
+    url:
+    - https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908
+    - https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
+---