Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 18.04 LTS USN-7442-1 critical: Ruby denial of service

ubuntu
Calendar Grey April 17, 2025
Dist Ubuntu Esm H88
The security advisory from Ubuntu underscores significant vulnerabilities in Ruby that affect resource allocation and pose risks of service disruption.
Several security issues were fixed in Ruby.

Summary

Several security issues were fixed in Ruby.

Software Description:

- ruby2.5: Object-oriented scripting language

- ruby2.3: Object-oriented scripting language

Details:

It was discovered that the Ruby CGI gem incorrectly handled parsing certain

cookies. A remote attacker could possibly use this issue to consume

resources, leading to a denial of service. (CVE-2025-27219)

It was discovered that the Ruby CGI gem incorrectly handled parsing certain

regular expressions. A remote attacker could possibly use this issue to

consume resources, leading to a denial of service. (CVE-2025-27220)

It was discovered that the Ruby URI gem incorrectly handled certain URI

handling methods. A remote attacker could possibly use this issue to leak

authentication credentials. (CVE-2025-27221)

It was discovered that the Ruby REXML gem incorrectly handled parsing XML

documents containing many digits in a hex numeric character reference. A

remote attacker could use this issue to co...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service update Ubuntu ruby resource consumption

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
   libruby2.5                      2.5.1-1ubuntu1.16+esm4
                                   Available with Ubuntu Pro
   ruby2.5                         2.5.1-1ubuntu1.16+esm4
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   libruby2.3                      2.3.1-2~ubuntu16.04.16+esm10
                                   Available with Ubuntu Pro
   ruby2.3                         2.3.1-2~ubuntu16.04.16+esm10
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7442-1

  CVE-2024-49761, CVE-2025-27219, CVE-2025-27220, CVE-2025-27221

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7442-1

Topics%20covered

Topics Covered

security advisory denial of service update Ubuntu ruby resource consumption

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here