==========================================================================
Ubuntu Security Notice USN-7442-1
April 17, 2025

ruby2.3, ruby2.5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ruby.

Software Description:
- ruby2.5: Object-oriented scripting language
- ruby2.3: Object-oriented scripting language

Details:

It was discovered that the Ruby CGI gem incorrectly handled parsing certain
cookies. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service. (CVE-2025-27219)

It was discovered that the Ruby CGI gem incorrectly handled parsing certain
regular expressions. A remote attacker could possibly use this issue to
consume resources, leading to a denial of service. (CVE-2025-27220)

It was discovered that the Ruby URI gem incorrectly handled certain URI
handling methods. A remote attacker could possibly use this issue to leak
authentication credentials. (CVE-2025-27221)

It was discovered that the Ruby REXML gem incorrectly handled parsing XML
documents containing many digits in a hex numeric character reference. A
remote attacker could use this issue to consume resources, leading to a
denial of service. (CVE-2024-49761)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
   libruby2.5                      2.5.1-1ubuntu1.16+esm4
                                   Available with Ubuntu Pro
   ruby2.5                         2.5.1-1ubuntu1.16+esm4
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   libruby2.3                      2.3.1-2~ubuntu16.04.16+esm10
                                   Available with Ubuntu Pro
   ruby2.3                         2.3.1-2~ubuntu16.04.16+esm10
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7442-1
   CVE-2024-49761, CVE-2025-27219, CVE-2025-27220, CVE-2025-27221