Skip to content
OpenAdvisories
Medium USN-6838-2 1 CVE

ruby2.3, ruby2.5 vulnerability

Published Feb 10, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-6838-1 fixed CVE-2024-27281 in Ruby 2.7, Ruby 3.0, Ruby 3.1,
and Ruby 3.2. This update provides the corresponding updates for
Ruby 2.3 and Ruby 2.5.

Original advisory details:

It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If
a user or automated system were tricked into parsing a specially crafted
.rdoc_options file, a remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2024-27281)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby2.3 2.3.1-2~ubuntu16.04.16+esm9
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby2.5 2.5.1-1ubuntu1.16+esm3

Vulnerabilities 1

  • Medium 4.5
    CVE-2024-27281

    RDoc RCE vulnerability with .rdoc_options

    An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no r…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2024-27281