Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Red Hat Ruby packages may let attackers run code
published 1 month ago
Summary
The Ruby programming language packages supplied by Red Hat, including the standard runtime and related debugging tools, contain a flaw that could allow an attacker to execute malicious code on a system that runs them. This could lead to unauthorized access or manipulation of data. Apply the latest Red Hat update for ruby, ruby‑debuginfo, ruby‑debugsource, ruby‑default‑gems, and ruby‑devel as soon as possible to close the issue.
What to do
- Update redhat ruby-debuginfo to version 0:3.0.7-168.el9_8.
- Update redhat ruby to version 0:3.0.7-168.el9_8.
- Update redhat ruby-debugsource to version 0:3.0.7-168.el9_8.
- Update redhat ruby-default-gems to version 0:3.0.7-168.el9_8.
- Update redhat ruby-devel to version 0:3.0.7-168.el9_8.
- Update redhat ruby-libs to version 0:3.0.7-168.el9_8.
- Update redhat ruby-libs-debuginfo to version 0:3.0.7-168.el9_8.
- Update redhat rubygem-bigdecimal to version 0:3.0.0-168.el9_8.
- Update redhat rubygem-bigdecimal-debuginfo to version 0:3.0.0-168.el9_8.
- Update redhat rubygem-bundler to version 0:2.2.33-168.el9_8.
- Update redhat rubygem-io-console to version 0:0.5.7-168.el9_8.
- Update redhat rubygem-io-console-debuginfo to version 0:0.5.7-168.el9_8.
- Update redhat rubygem-irb to version 0:1.3.5-168.el9_8.
- Update redhat rubygem-json to version 0:2.5.1-168.el9_8.
- Update redhat rubygem-json-debuginfo to version 0:2.5.1-168.el9_8.
- Update redhat rubygem-minitest to version 0:5.14.2-168.el9_8.
- Update redhat rubygem-power_assert to version 0:1.2.1-168.el9_8.
- Update redhat rubygem-psych to version 0:3.3.2-168.el9_8.
- Update redhat rubygem-psych-debuginfo to version 0:3.3.2-168.el9_8.
- Update redhat rubygem-rake to version 0:13.0.3-168.el9_8.
- Update redhat rubygem-rbs to version 0:1.4.0-168.el9_8.
- Update redhat rubygem-rdoc to version 0:6.3.4.1-168.el9_8.
- Update redhat rubygem-rexml to version 0:3.2.5-168.el9_8.
- Update redhat rubygem-rss to version 0:0.2.9-168.el9_8.
- Update redhat rubygem-test-unit to version 0:3.3.7-168.el9_8.
- Update redhat rubygem-typeprof to version 0:0.15.2-168.el9_8.
- Update redhat rubygems to version 0:3.2.33-168.el9_8.
- Update redhat rubygems-devel to version 0:3.2.33-168.el9_8.
- Update redhat ruby-doc to version 0:3.0.7-168.el9_8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby-debuginfo |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby-debugsource |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby-default-gems |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby-devel |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby-libs |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | ruby-libs-debuginfo |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-bigdecimal |
< 0:3.0.0-168.el9_8 Fix: upgrade to 0:3.0.0-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-bigdecimal-debuginfo |
< 0:3.0.0-168.el9_8 Fix: upgrade to 0:3.0.0-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-bundler |
< 0:2.2.33-168.el9_8 Fix: upgrade to 0:2.2.33-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-io-console |
< 0:0.5.7-168.el9_8 Fix: upgrade to 0:0.5.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-io-console-debuginfo |
< 0:0.5.7-168.el9_8 Fix: upgrade to 0:0.5.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-irb |
< 0:1.3.5-168.el9_8 Fix: upgrade to 0:1.3.5-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-json |
< 0:2.5.1-168.el9_8 Fix: upgrade to 0:2.5.1-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-json-debuginfo |
< 0:2.5.1-168.el9_8 Fix: upgrade to 0:2.5.1-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-minitest |
< 0:5.14.2-168.el9_8 Fix: upgrade to 0:5.14.2-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-power_assert |
< 0:1.2.1-168.el9_8 Fix: upgrade to 0:1.2.1-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-psych |
< 0:3.3.2-168.el9_8 Fix: upgrade to 0:3.3.2-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-psych-debuginfo |
< 0:3.3.2-168.el9_8 Fix: upgrade to 0:3.3.2-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-rake |
< 0:13.0.3-168.el9_8 Fix: upgrade to 0:13.0.3-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-rbs |
< 0:1.4.0-168.el9_8 Fix: upgrade to 0:1.4.0-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-rdoc |
< 0:6.3.4.1-168.el9_8 Fix: upgrade to 0:6.3.4.1-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-rexml |
< 0:3.2.5-168.el9_8 Fix: upgrade to 0:3.2.5-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-rss |
< 0:0.2.9-168.el9_8 Fix: upgrade to 0:0.2.9-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-test-unit |
< 0:3.3.7-168.el9_8 Fix: upgrade to 0:3.3.7-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygem-typeprof |
< 0:0.15.2-168.el9_8 Fix: upgrade to 0:0.15.2-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygems |
< 0:3.2.33-168.el9_8 Fix: upgrade to 0:3.2.33-168.el9_8
|
| Red Hat:enterprise_linux:9::appstream | redhat | rubygems-devel |
< 0:3.2.33-168.el9_8 Fix: upgrade to 0:3.2.33-168.el9_8
|
| Red Hat:enterprise_linux:9::crb | redhat | ruby-doc |
< 0:3.0.7-168.el9_8 Fix: upgrade to 0:3.0.7-168.el9_8
|
Original advisory text
Red Hat Security Advisory: ruby security, bug fix, and enhancement update
References
- https://access.redhat.com/errata/RHSA-2026:72286 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72286.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-80212 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2525066 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-80212 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80212 Vendor Advisory
- https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea Third Party Advisory
- https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/ Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published28 Sep 2026
Updated28 Sep 2026
First seen28 Sep 2026
Sources
RHSA-2026:72286 · OSV
Track software like this
Free during beta