Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Ruby Vulnerability Affects Red Hat Systems

published 4 months ago

Summary

A security update is available for Ruby on Red Hat systems. This update addresses a vulnerability that could allow an attacker to execute arbitrary code. Users are advised to update their Ruby installations to fix this issue.

What to do

Update redhat rubygems to version 0:3.2.33-161.el9_2.3.
Update redhat ruby to version 0:3.0.4-161.el9_2.3.
Update redhat ruby-debuginfo to version 0:3.0.4-161.el9_2.3.
Update redhat ruby-debugsource to version 0:3.0.4-161.el9_2.3.
Update redhat ruby-default-gems to version 0:3.0.4-161.el9_2.3.
Update redhat ruby-devel to version 0:3.0.4-161.el9_2.3.
Update redhat ruby-libs to version 0:3.0.4-161.el9_2.3.
Update redhat ruby-libs-debuginfo to version 0:3.0.4-161.el9_2.3.
Update redhat rubygem-bigdecimal to version 0:3.0.0-161.el9_2.3.
Update redhat rubygem-bigdecimal-debuginfo to version 0:3.0.0-161.el9_2.3.
Update redhat rubygem-bundler to version 0:2.2.33-161.el9_2.3.
Update redhat rubygem-io-console to version 0:0.5.7-161.el9_2.3.
Update redhat rubygem-io-console-debuginfo to version 0:0.5.7-161.el9_2.3.
Update redhat rubygem-irb to version 0:1.3.5-161.el9_2.3.
Update redhat rubygem-json to version 0:2.5.1-161.el9_2.3.
Update redhat rubygem-json-debuginfo to version 0:2.5.1-161.el9_2.3.
Update redhat rubygem-minitest to version 0:5.14.2-161.el9_2.3.
Update redhat rubygem-power_assert to version 0:1.2.0-161.el9_2.3.
Update redhat rubygem-psych to version 0:3.3.2-161.el9_2.3.
Update redhat rubygem-psych-debuginfo to version 0:3.3.2-161.el9_2.3.
Update redhat rubygem-rake to version 0:13.0.3-161.el9_2.3.
Update redhat rubygem-rbs to version 0:1.4.0-161.el9_2.3.
Update redhat rubygem-rdoc to version 0:6.3.3-161.el9_2.3.
Update redhat rubygem-rexml to version 0:3.2.5-161.el9_2.3.
Update redhat rubygem-rss to version 0:0.2.9-161.el9_2.3.
Update redhat rubygem-test-unit to version 0:3.3.7-161.el9_2.3.
Update redhat rubygem-typeprof to version 0:0.15.2-161.el9_2.3.
Update redhat rubygems-devel to version 0:3.2.33-161.el9_2.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygems	< 0:3.2.33-161.el9_2.3 Fix: upgrade to 0:3.2.33-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby-debuginfo	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby-debugsource	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby-default-gems	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby-devel	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby-libs	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	ruby-libs-debuginfo	< 0:3.0.4-161.el9_2.3 Fix: upgrade to 0:3.0.4-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-bigdecimal	< 0:3.0.0-161.el9_2.3 Fix: upgrade to 0:3.0.0-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-bigdecimal-debuginfo	< 0:3.0.0-161.el9_2.3 Fix: upgrade to 0:3.0.0-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-bundler	< 0:2.2.33-161.el9_2.3 Fix: upgrade to 0:2.2.33-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-io-console	< 0:0.5.7-161.el9_2.3 Fix: upgrade to 0:0.5.7-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-io-console-debuginfo	< 0:0.5.7-161.el9_2.3 Fix: upgrade to 0:0.5.7-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-irb	< 0:1.3.5-161.el9_2.3 Fix: upgrade to 0:1.3.5-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-json	< 0:2.5.1-161.el9_2.3 Fix: upgrade to 0:2.5.1-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-json-debuginfo	< 0:2.5.1-161.el9_2.3 Fix: upgrade to 0:2.5.1-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-minitest	< 0:5.14.2-161.el9_2.3 Fix: upgrade to 0:5.14.2-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-power_assert	< 0:1.2.0-161.el9_2.3 Fix: upgrade to 0:1.2.0-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-psych	< 0:3.3.2-161.el9_2.3 Fix: upgrade to 0:3.3.2-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-psych-debuginfo	< 0:3.3.2-161.el9_2.3 Fix: upgrade to 0:3.3.2-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-rake	< 0:13.0.3-161.el9_2.3 Fix: upgrade to 0:13.0.3-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-rbs	< 0:1.4.0-161.el9_2.3 Fix: upgrade to 0:1.4.0-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-rdoc	< 0:6.3.3-161.el9_2.3 Fix: upgrade to 0:6.3.3-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-rexml	< 0:3.2.5-161.el9_2.3 Fix: upgrade to 0:3.2.5-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-rss	< 0:0.2.9-161.el9_2.3 Fix: upgrade to 0:0.2.9-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-test-unit	< 0:3.3.7-161.el9_2.3 Fix: upgrade to 0:3.3.7-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygem-typeprof	< 0:0.15.2-161.el9_2.3 Fix: upgrade to 0:0.15.2-161.el9_2.3
Red Hat:rhel_e4s:9.2::appstream	redhat	rubygems-devel	< 0:3.2.33-161.el9_2.3 Fix: upgrade to 0:3.2.33-161.el9_2.3

Original advisory text

Red Hat Security Advisory: ruby security update

References

https://access.redhat.com/errata/RHSA-2026:35834 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2461369 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2468498 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2468499 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35834.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-41316 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-41316 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41316 Vendor Advisory
https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-42246 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42246 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42246 Vendor Advisory
https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618 Third Party Advisory
https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e Third Party Advisory
https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c Third Party Advisory
https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da Third Party Advisory
https://github.com/ruby/net-imap/releases/tag/v0.3.10 Third Party Advisory
https://github.com/ruby/net-imap/releases/tag/v0.4.24 Third Party Advisory
https://github.com/ruby/net-imap/releases/tag/v0.5.14 Third Party Advisory
https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-42258 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42258 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42258 Vendor Advisory
https://github.com/ruby/net-imap/releases/tag/v0.6.4 Third Party Advisory
https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Timeline

Published6 Jul 2026

Updated8 Jul 2026

First seen8 Jul 2026

Sources

RHSA-2026:35834 · OSV

Track software like this

Free during beta