==========================================================================
Ubuntu Security Notice USN-8137-1
March 31, 2026

ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Ruby could be made to expose sensitive information.

Software Description:
- ruby3.3: Object-oriented scripting language
- ruby3.2: Object-oriented scripting language
- ruby3.0: Object-oriented scripting language
- ruby2.7: Object-oriented scripting language
- ruby2.5: Object-oriented scripting language
- ruby2.3: Object-oriented scripting language

Details:

It was discovered that the Ruby URI gem did not properly handle sensitive
information when combining URIs. A remote attacker could possibly use this
issue to leak authentication credentials.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  libruby3.3                      3.3.8-2ubuntu2.1
  ruby3.3                         3.3.8-2ubuntu2.1

Ubuntu 24.04 LTS
  libruby3.2                      3.2.3-1ubuntu0.24.04.7
  ruby3.2                         3.2.3-1ubuntu0.24.04.7

Ubuntu 22.04 LTS
  libruby3.0                      3.0.2-7ubuntu2.12
  ruby3.0                         3.0.2-7ubuntu2.12

Ubuntu 20.04 LTS
  libruby2.7                      2.7.0-5ubuntu1.18+esm4
                                  Available with Ubuntu Pro
  ruby2.7                         2.7.0-5ubuntu1.18+esm4
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libruby2.5                      2.5.1-1ubuntu1.16+esm7
                                  Available with Ubuntu Pro
  ruby2.5                         2.5.1-1ubuntu1.16+esm7
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libruby2.3                      2.3.1-2~ubuntu16.04.16+esm12
                                  Available with Ubuntu Pro
  ruby2.3                         2.3.1-2~ubuntu16.04.16+esm12
                                  Available with Ubuntu Pro
  ruby2.3-tcltk                   2.3.1-2~ubuntu16.04.16+esm12
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8137-1
  CVE-2025-61594

Package Information:
  https://launchpad.net/ubuntu/+source/ruby3.3/3.3.8-2ubuntu2.1
  https://launchpad.net/ubuntu/+source/ruby3.2/3.2.3-1ubuntu0.24.04.7
  https://launchpad.net/ubuntu/+source/ruby3.0/3.0.2-7ubuntu2.12