Description
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-zip | 2.0.0-1 | — |
| Debian 13 | ruby-zip | 2.0.0-1 | — |
| Debian 12 | ruby-zip | 2.0.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ruby-zip | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-zip | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +5 | 5.10.13.1-1.el7cf | RHSA-2019:4201, RHBA-2019:4047 |
| Red Hat CloudForms 5 | ovirt-ansible-hosted-engine-setup | 1.0.28-1.el8ev | RHSA-2019:4201 |
| Red Hat CloudForms 5 | ruby +4 | 2.4.9-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-bigdecimal | 1.3.2-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-did_you_mean | 1.1.0-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-io-console | 0.4.6-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-minitest | 5.10.1-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-net-telnet | 0.1.1-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-openssl | 2.0.9-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-power_assert | 0.4.1-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-psych | 2.2.2-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-rake | 12.0.0-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-rdoc | 5.0.1-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-test-unit | 3.2.3-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygem-xmlrpc | 0.2.1-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | rubygems +1 | 2.6.14.4-93.el7cf | RHBA-2019:4047 |
| Red Hat CloudForms 5 | v2v-conversion-host +1 | 1.15.0-1.el8ev | RHSA-2019:4201 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | vagrant | 2.2.18-1.3 | openSUSE-SU-2024:11491-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rubyzip | < 1.3.0 | 1.3.0 | GHSA-5m2v-hc64-56h6 |
Advisories 3
- RHSA-2019:4201 Red Hat Security Advisory: CloudForms 5.0.1 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHBA-2019:4047 Red Hat Bug Fix Advisory: CloudForms 4.7.13 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- openSUSE-SU-2024:11491-1 vagrant-2.2.18-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/rubyzip/rubyzip/pull/403
- FEDORA-2019-0182d0b304 vendor-advisory
- FEDORA-2019-8ecd991303 vendor-advisory
- FEDORA-2019-52445dce42 vendor-advisory
- RHBA-2019:4047 vendor-advisory
- RHSA-2019:4201 vendor-advisory
- https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e