aws / aws/aws-codedeploy-agent
Update Deps for rexml to address dos-rexml-cve-2025-58767
- Dominant language
- Rust
- Stars
- 337
- Forks
- 195
- Avg merge
- 10h 54m
- Merged PRs (30d)
- 4
Description
AWS CodeDeploy Agent is built with and ships rexml-3.3.9 which is being flagged by our security team as an issue.
This version of rexml has a known vulnerability:
[https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ ](https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/)
The gem must be updated to 3.4.1 or higher.
We are currently running the latest version of the AWS Code Deploy agent.
[https://github.com/aws/aws-codedeploy-agent/releases/tag/v1.8.0 ](https://github.com/aws/aws-codedeploy-agent/releases/tag/v1.8.0)
Its version pinned to 3.3.9:
[https://github.com/aws/aws-codedeploy-agent/blob/main/codedeploy_agent.gemspec#L23 ](https://github.com/aws/aws-codedeploy-agent/blob/main/codedeploy_agent.gemspec#L23)
Can AWS Please update the agent and release a new version with the updated gems.
We have reported this under case ID 176122302300952
Contributor guide
Assessment
This issue has not been assessed yet.