Update Deps for rexml to address dos-rexml-cve-2025-58767

[bmccafferty]

AWS CodeDeploy Agent is built with and ships rexml-3.3.9 which is being flagged by our security team as an issue.

This version of rexml has a known vulnerability:
https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/

The gem must be updated to 3.4.1 or higher.

We are currently running the latest version of the AWS Code Deploy agent.
https://github.com/aws/aws-codedeploy-agent/releases/tag/v1.8.0

Its version pinned to 3.3.9:
https://github.com/aws/aws-codedeploy-agent/blob/main/codedeploy_agent.gemspec#L23

Can AWS Please update the agent and release a new version with the updated gems.

We have reported this under case ID 176122302300952

[tprescott-telligen]

Seconding this. This is flagging on our vulnerability reports.

[bmccafferty]

This was the reply we got from AWS Support... Not really ideal...

Hello Team,

Thank you very much for your patience until Internal team reverted back with an update.

Please find following update from Internal team:

Thank you for contacting us regarding the CVE-2025-58767 in the REXML Ruby library used by the CodeDeploy agent. We can confirm this issue affects CodeDeploy agent version 1.8, which uses Ruby REXML 3.3.3.

We are currently working on addressing this issue. Our security team has assessed the risk as low, as it only applies when parsing untrusted XML. The CodeDeploy agent does not parse untrusted XML during its operations. We are planning to update the REXML library in a future release of the CodeDeploy agent, currently scheduled for Q2 2026, due to the low risk assessment.

We recommend you continue using the current version of the CodeDeploy agent. Updating the REXML library independently could potentially impact the functionality of the CodeDeploy agent.

We would like to schedule a follow-up meeting to discuss our risk assessment and next steps in more detail. Your AWS Technical Account Manager will reach out to coordinate this discussion.

We appreciate your patience as we work on this update.

If you have questions or concerns, please let me know and I will be glad to help you.

We value your feedback. Please share your experience by rating this and other correspondences in the AWS Support Center. You can rate a correspondence by selecting the stars in the top right corner of the correspondence.

Best regards,
Amazon Web Services

[tcprescott]

This is also the same answer I got about this.