Skip to content
OpenAdvisories
Medium ALAS2023-2025-1131 1 CVE

Moderate: ruby3.2 security update (Amazon Linux 2023)

Published Jul 29, 2025 · Updated Aug 8, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-24294: The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Fixed packages 32

ReleasePackageFixed in
Amazon Linux · 2023 ruby3.2 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-bundled-gems 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-bundled-gems-debuginfo 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-debuginfo 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-debugsource 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-default-gems 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-devel 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-doc 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-libs 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-libs-debuginfo 0:3.2.8-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-bigdecimal 0:3.1.3-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-bigdecimal-debuginfo 0:3.1.3-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-bundler 0:2.4.19-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-io-console 0:0.6.0-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-io-console-debuginfo 0:0.6.0-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-irb 0:1.6.2-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-json 0:2.6.3-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-json-debuginfo 0:2.6.3-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-minitest 0:5.25.1-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-power_assert 0:2.0.3-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-psych 0:5.0.1-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-psych-debuginfo 0:5.0.1-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-rake 0:13.0.6-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-rbs 0:2.8.2-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-rbs-debuginfo 0:2.8.2-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-rdoc 0:6.5.1.1-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-rexml 0:3.3.9-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-rss 0:0.3.1-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-test-unit 0:3.5.7-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygem-typeprof 0:0.21.3-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygems 0:3.4.19-184.amzn2023.0.3
Amazon Linux · 2023 ruby3.2-rubygems-devel 0:3.4.19-184.amzn2023.0.3

Vulnerabilities 1

  • High 7.5

    resolv vulnerable to DoS via insufficient DNS domain name length validation

    The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-24294.html