Red Hat Security Advisory: ruby security update

Fixed packages 34

Vulnerabilities 3

• Medium 6.5
  CVE-2025-25186

  Net::IMAP vulnerable to possible DoS by memory exhaustion

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response par…

  ruby net-imap kube-fluentd-operator kube-fluentd-operator-compat Debian Ubuntu Azure Linux Wolfi RubyGems
  Feb 10, 2025
• Medium 5.8
  CVE-2025-27219

  CGI has Denial of Service (DoS) potential in Cookie.parse

  In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead …

  ruby-lang CGI ruby2.3 ruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Mar 3, 2025
• Low 3.2
  CVE-2025-27221

  URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

  In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

  ruby-lang URI kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems
  Mar 3, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2344680
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2349699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2349700
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8131.json
• report
  https://access.redhat.com/security/cve/CVE-2025-25186
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-25186
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-25186
• article
  https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35
• article
  https://github.com/ruby/net-imap/commit/c8c5a643739d2669f0c9a6bb9770d0c045fd74a3
• article
  https://github.com/ruby/net-imap/commit/cb92191b1ddce2d978d01b56a0883b6ecf0b1022
• article
  https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69
• report
  https://access.redhat.com/security/cve/CVE-2025-27219
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-27219
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-27219
• article
  https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
• report
  https://access.redhat.com/security/cve/CVE-2025-27221
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-27221
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-27221
• article
  https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
• article
  https://hackerone.com/reports/2957667