========================================================================== Ubuntu Security Notice USN-7442-1 April 17, 2025
ruby2.3, ruby2.5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Ruby. Software Description: - ruby2.5: Object-oriented scripting language - ruby2.3: Object-oriented scripting language Details: It was discovered that the Ruby CGI gem incorrectly handled parsing certain cookies. A remote attacker could possibly use this issue to consume resources, leading to a denial of service. (CVE-2025-27219) It was discovered that the Ruby CGI gem incorrectly handled parsing certain regular expressions. A remote attacker could possibly use this issue to consume resources, leading to a denial of service. (CVE-2025-27220) It was discovered that the Ruby URI gem incorrectly handled certain URI handling methods. A remote attacker could possibly use this issue to leak authentication credentials. (CVE-2025-27221) It was discovered that the Ruby REXML gem incorrectly handled parsing XML documents containing many digits in a hex numeric character reference. A remote attacker could use this issue to consume resources, leading to a denial of service. (CVE-2024-49761) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS libruby2.5 2.5.1-1ubuntu1.16+esm4 Available with Ubuntu Pro ruby2.5 2.5.1-1ubuntu1.16+esm4 Available with Ubuntu Pro Ubuntu 16.04 LTS libruby2.3 2.3.1-2~ubuntu16.04.16+esm10 Available with Ubuntu Pro ruby2.3 2.3.1-2~ubuntu16.04.16+esm10 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7442-1 CVE-2024-49761, CVE-2025-27219, CVE-2025-27220, CVE-2025-27221
OpenPGP_signature.asc
Description: OpenPGP digital signature
