Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Ruby URI library may expose passwords when URLs change

published 1 year ago
Summary

The Ruby URI library (versions before 1.0.3) can keep user names and passwords in a URL even after the host is modified, which could unintentionally reveal credentials. This affects Ruby applications that use the URI.join, URI#merge, or URI+ methods. Update the library to version 1.0.3 or later, or avoid using those methods with sensitive URLs.

What to do
  • Update azure ruby to version 3.3.5-3.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure ruby < 3.3.5-3
Fix: upgrade to 3.3.5-3
Original advisory text
CVE-2025-27221 affecting package ruby for versions less than 3.3.5-3
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Timeline
Published4 Mar 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-57893 · OSV
Track software like this
Free during beta