Skip to content
OpenAdvisories
Medium ALAS2-2025-2957 1 CVE

Moderate: ruby security update (Amazon Linux 2)

Published Jul 29, 2025 · Updated Aug 4, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-24294: The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 ruby-devel 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 ruby-doc 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 ruby-irb 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 ruby-libs 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-36.amzn2.0.16
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-36.amzn2.0.16
Amazon Linux · 2 rubygem-io-console 0:0.4.2-36.amzn2.0.16
Amazon Linux · 2 rubygem-json 0:1.7.7-36.amzn2.0.16
Amazon Linux · 2 rubygem-minitest 0:4.3.2-36.amzn2.0.16
Amazon Linux · 2 rubygem-psych 0:2.0.0-36.amzn2.0.16
Amazon Linux · 2 rubygem-rake 0:0.9.6-36.amzn2.0.16
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-36.amzn2.0.16
Amazon Linux · 2 rubygems 0:2.0.14.1-36.amzn2.0.16
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-36.amzn2.0.16

Vulnerabilities 1

  • High 7.5

    resolv vulnerable to DoS via insufficient DNS domain name length validation

    The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-24294.html