Skip to content
OpenAdvisories
Medium RHSA-2025:7539 2 CVEs

Red Hat Security Advisory: ruby:2.5 security update

Published May 14, 2025 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 46

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-debuginfo 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-debugsource 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-devel 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-doc 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-irb 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-libs 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-libs-debuginfo 0:2.5.9-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-abrt 0:0.3.0-4.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-abrt-doc 0:0.3.0-4.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bigdecimal 0:1.3.4-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bigdecimal-debuginfo 0:1.3.4-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson 0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson-debuginfo 0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson-debugsource 0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson-doc 0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bundler 0:1.16.1-5.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bundler-doc 0:1.16.1-5.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-did_you_mean 0:1.2.0-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-io-console 0:0.4.6-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-io-console-debuginfo 0:0.4.6-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-json 0:2.1.0-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-json-debuginfo 0:2.1.0-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-minitest 0:5.10.3-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mongo 0:2.5.1-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mongo-doc 0:2.5.1-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2 0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2-debuginfo 0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2-debugsource 0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2-doc 0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-net-telnet 0:0.1.1-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-openssl 0:2.1.2-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-openssl-debuginfo 0:2.1.2-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg 0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg-debuginfo 0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg-debugsource 0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg-doc 0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-power_assert 0:1.1.1-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-psych 0:3.0.2-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-psych-debuginfo 0:3.0.2-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-rake 0:12.3.3-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-rdoc 0:6.0.1.1-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-test-unit 0:3.2.7-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-xmlrpc 0:0.3.0-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygems 0:2.7.6.3-114.module+el8.10.0+23088+750dc6ca
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygems-devel 0:2.7.6.3-114.module+el8.10.0+23088+750dc6ca

Vulnerabilities 2

  • Medium 6.7
    CVE-2021-43809

    Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile

    `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit…

    rubygems rubygems rubygems bundler Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2019-19012 Public exploit EPSS 11%

    An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-b…

    libonig libonig Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1802051
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2035260
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7539.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-19012
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-19012
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-19012
  • report
    https://access.redhat.com/security/cve/CVE-2021-43809
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-43809
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-43809