Skip to content
OpenAdvisories
Medium ELSA-2025-7539 2 CVEs

Moderate: ruby:2.5 security update (Oracle Linux 8)

Published May 16, 2025 · Updated May 16, 2025

Ecosystem: Oracle Linux

Summary

ruby
[2.5.9-114]
- Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012).
Resolves: RHEL-87505

rubygem-abrt
rubygem-bson
rubygem-bundler
[1.16.1-5]
- Fix unexpected code execution in Gemfiles (CVE-2021-43809)
Resolves: RHEL-87017

rubygem-mongo
rubygem-mysql2
rubygem-pg

Fixed packages 32

ReleasePackageFixed in
Oracle Linux · 8 ruby 0:2.5.9-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 ruby-devel 0:2.5.9-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 ruby-doc 0:2.5.9-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 ruby-irb 0:2.5.9-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 ruby-libs 0:2.5.9-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-abrt 0:0.3.0-4.module+el8.10.0+90367+ae9e8511
Oracle Linux · 8 rubygem-abrt-doc 0:0.3.0-4.module+el8.10.0+90367+ae9e8511
Oracle Linux · 8 rubygem-bigdecimal 0:1.3.4-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-bson 0:4.3.0-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bson-doc 0:4.3.0-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bundler 0:1.16.1-5.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-bundler-doc 0:1.16.1-5.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-did_you_mean 0:1.2.0-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-io-console 0:0.4.6-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-json 0:2.1.0-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-minitest 0:5.10.3-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-mongo 0:2.5.1-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mongo-doc 0:2.5.1-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mysql2 0:0.4.10-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mysql2-doc 0:0.4.10-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-net-telnet 0:0.1.1-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-openssl 0:2.1.2-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-pg 0:1.0.0-3.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-pg-doc 0:1.0.0-3.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-power_assert 0:1.1.1-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-psych 0:3.0.2-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-rake 0:12.3.3-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-rdoc 0:6.0.1.1-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-test-unit 0:3.2.7-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygem-xmlrpc 0:0.3.0-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygems 0:2.7.6.3-114.module+el8.10.0+90580+29305b94
Oracle Linux · 8 rubygems-devel 0:2.7.6.3-114.module+el8.10.0+90580+29305b94

Vulnerabilities 2

  • Medium 6.7
    CVE-2021-43809

    Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile

    `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit…

    rubygems rubygems rubygems bundler Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2019-19012 Public exploit EPSS 11%

    An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-b…

    libonig libonig Debian Ubuntu