Skip to content
OpenAdvisories
Medium DLA-4163-1 3 CVEs

rubygems - security update

Published May 12, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 rubygems 3.2.5-2+deb11u1

Vulnerabilities 3

  • Medium 6.7
    CVE-2021-43809

    Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile

    `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit…

    rubygems rubygems rubygems bundler Debian Ubuntu Alpine RubyGems
  • Medium 5.3
    CVE-2023-28755

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  • Low 3.2
    CVE-2025-27221

    URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

    In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

    ruby-lang URI kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems