Skip to content
OpenAdvisories
Medium ELSA-2025-23141 3 CVEs

Moderate: ruby security update (Oracle Linux 10)

Published Dec 11, 2025 · Updated Dec 11, 2025

Ecosystem: Oracle Linux

Summary

[3.3.10-11]
- Upgrade to Ruby 3.3.10.
Resolves: RHEL-130160
- Fix possible denial of service in resolv gem (CVE-2025-24294)
- Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
- Fix REXML denial of service. (CVE-2025-58767)
Resolves: RHEL-122028

Fixed packages 24

ReleasePackageFixed in
Oracle Linux · 10 ruby 0:3.3.10-11.el10_1
Oracle Linux · 10 ruby-bundled-gems 0:3.3.10-11.el10_1
Oracle Linux · 10 ruby-default-gems 0:3.3.10-11.el10_1
Oracle Linux · 10 ruby-devel 0:3.3.10-11.el10_1
Oracle Linux · 10 ruby-doc 0:3.3.10-11.el10_1
Oracle Linux · 10 ruby-libs 0:3.3.10-11.el10_1
Oracle Linux · 10 rubygem-bigdecimal 0:3.1.5-11.el10_1
Oracle Linux · 10 rubygem-bundler 0:2.5.22-11.el10_1
Oracle Linux · 10 rubygem-io-console 0:0.7.1-11.el10_1
Oracle Linux · 10 rubygem-irb 0:1.13.1-11.el10_1
Oracle Linux · 10 rubygem-json 0:2.7.2-11.el10_1
Oracle Linux · 10 rubygem-minitest 0:5.20.0-11.el10_1
Oracle Linux · 10 rubygem-power_assert 0:2.0.3-11.el10_1
Oracle Linux · 10 rubygem-psych 0:5.1.2-11.el10_1
Oracle Linux · 10 rubygem-racc 0:1.7.3-11.el10_1
Oracle Linux · 10 rubygem-rake 0:13.1.0-11.el10_1
Oracle Linux · 10 rubygem-rbs 0:3.4.0-11.el10_1
Oracle Linux · 10 rubygem-rdoc 0:6.6.3.1-11.el10_1
Oracle Linux · 10 rubygem-rexml 0:3.4.4-11.el10_1
Oracle Linux · 10 rubygem-rss 0:0.3.1-11.el10_1
Oracle Linux · 10 rubygem-test-unit 0:3.6.1-11.el10_1
Oracle Linux · 10 rubygem-typeprof 0:0.21.9-11.el10_1
Oracle Linux · 10 rubygems 0:3.5.22-11.el10_1
Oracle Linux · 10 rubygems-devel 0:3.5.22-11.el10_1

Vulnerabilities 3

  • High 7.5
    CVE-2025-24294

    resolv vulnerable to DoS via insufficient DNS domain name length validation

    The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain …

    ruby resolv ruby2.3 ruby2.5 Debian Ubuntu Azure Linux Wolfi RubyGems
  • Low 2.1
    CVE-2025-61594

    URI Credential Leakage Bypass over CVE-2025-27221

    URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to…

    ruby uri ruby2.3 ruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  • Low 1.2
    CVE-2025-58767

    REXML has a DoS condition when parsing malformed XML file

    REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later…

    ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems