Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Critical Update Needed for Ruby: Protection Against Data Corruption and Attacks

RLSA-2023:7025
Summary

An update is available for Ruby to fix critical security issues that could allow attackers to manipulate web applications and corrupt data. This update is essential to prevent potential data breaches and ensure the integrity of your systems. You should install the update as soon as possible to protect your data and applications.

What to do
  • Update rubygem-mongo to version 0:2.5.1-2.module+el8.9.0+1536+5f79634e.
  • Update rubygem-mysql2 to version 0:0.4.10-4.module+el8.9.0+1536+5f79634e.
  • Update ruby to version 0:2.5.9-111.module+el8.9.0+1536+5f79634e.
  • Update rubygem-abrt to version 0:0.3.0-4.module+el8.9.0+1536+5f79634e.
  • Update rubygem-abrt to version 0:0.3.0-4.module+el8.5.0+738+032c9c02.
  • Update rubygem-bson to version 0:4.3.0-2.module+el8.9.0+1536+5f79634e.
  • Update rubygem-bundler to version 0:1.16.1-4.module+el8.9.0+1536+5f79634e.
  • Update rubygem-pg to version 0:1.0.0-3.module+el8.9.0+1536+5f79634e.
Affected software
VendorProductAffected versionsFix available
– rubygem-mongo <= 0:2.5.1-2.module+el8.9.0+1536+5f79634e 0:2.5.1-2.module+el8.9.0+1536+5f79634e
– rubygem-mysql2 <= 0:0.4.10-4.module+el8.9.0+1536+5f79634e 0:0.4.10-4.module+el8.9.0+1536+5f79634e
– ruby <= 0:2.5.9-111.module+el8.9.0+1536+5f79634e 0:2.5.9-111.module+el8.9.0+1536+5f79634e
– rubygem-abrt <= 0:0.3.0-4.module+el8.9.0+1536+5f79634e 0:0.3.0-4.module+el8.9.0+1536+5f79634e
– rubygem-abrt <= 0:0.3.0-4.module+el8.5.0+738+032c9c02 0:0.3.0-4.module+el8.5.0+738+032c9c02
– rubygem-bson <= 0:4.3.0-2.module+el8.9.0+1536+5f79634e 0:4.3.0-2.module+el8.9.0+1536+5f79634e
– rubygem-bundler <= 0:1.16.1-4.module+el8.9.0+1536+5f79634e 0:1.16.1-4.module+el8.9.0+1536+5f79634e
– rubygem-pg <= 0:1.0.0-3.module+el8.9.0+1536+5f79634e 0:1.0.0-3.module+el8.9.0+1536+5f79634e
Original title
Moderate: ruby:2.5 security update
Original description
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

* ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

* ruby: ReDoS vulnerability in URI (CVE-2023-28755)

* ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.
osv CVSS3.1 8.8
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026