Description
The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rubygems | 4.0.15-2 | — |
| Debian 13 | rubygems | No fix yet | — |
| Debian 12 | rubygems | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.4 +5 | 3.4.12-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bigdecimal | 3.1.8-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bundler | 2.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-io-console | 0.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-irb | 1.14.3-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-json | 2.9.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-minitest | 5.25.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-power_assert | 2.0.5-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-psych | 5.2.2-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-racc | 1.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rake | 13.2.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rbs | 3.8.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rdoc | 6.14.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rexml | 3.4.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rss | 0.3.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-test-unit | 3.6.7-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-typeprof | 0.30.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygems +1 | 3.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby4.0 +6 | 4.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-io-console | 0.8.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-irb | 1.16.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-json | 2.18.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-minitest | 6.0.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-power_assert | 3.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-psych | 5.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-racc | 1.8.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rake | 13.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rbs | 3.10.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rdoc | 7.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rexml | 3.4.4-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rss | 0.3.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-test-unit | 3.7.5-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-typeprof | 0.31.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygems +2 | 4.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ruby | No fix yet | — |
Advisories 2
- ALAS2023-2026-3400 Important: ruby4.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3413 Important: ruby3.4 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026