Red Hat Security Advisory

RHSA-2025:4487

ruby security update

Released 2025-05-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) ruby-doc-3.0.7-165.el9_5
Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-165.el9_5, ruby-default-gems-3.0.7-165.el9_5, ruby-devel-3.0.7-165.el9_5 +18

TI-2025-20077 CVE-2025-27220 · GHSA-mhwm-jh88-3gjf

LOW 34

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0076 Published 2025-03-03 Partial fix · 0.3.5.1, 0.3.7 +1 CWE-1333

TI-2025-20076 CVE-2025-27219 · GHSA-gh9q-2xrm-x6qv

LOW 34

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00849 Published 2025-03-03 Partial fix · 0.3.5.1, 0.3.7 +1 CWE-770