[USN-7442-1] Ruby vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmgBGdsFAwAAAAAACgkQa1+PL+d1/EhD
iQv9HHL3gIF9dO4kM9HaaIP3YdXoiMmNOGM72n3Y53RcZxu8AxQxsJCG3E8BwNb3qbjc0LIoy2NY
QVwRD59ZjA70IjBM3k+Vfb6M5AbTLPPMntP9iLBD8BGfPmDrTdH2CpJFLGqU6oAat6zktd9nGkvu
J26/KbK13yWF2owUvPOerHQLjRg98KC4XWk8Qoezxly1d10YMsWgXkshdCosEYCuYpH0QNTLa3jm
Y1umbNtRujPqeo+VHY2BiifZ+f84i2GwvrHqZ+cqFMsxcMCnhitIZfvRL5xHFTIowL6yajPOwXUc
AV/fNTQojM3jWm3Yl6b2jFXzf5PxiB8GMsrhM9RcBpauEcIoOwiHDYBaDRHjT1sbizb8hgfp/9iG
wHBd9kuVMrzf0WCIgNAdnpEU3/Ao5vWL5zCEJ1QxRaxQ+pPq6dUWk/s2adheKiDvLJW0MAUPQGky
oUSsxFiujGpeSTue0guNImSfsAGCZ7NAHreWl3F9TrSJYcm0sHRlZMlkmMTF
=scRQ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7442-1
April 17, 2025

ruby2.3, ruby2.5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ruby.

Software Description:
- ruby2.5: Object-oriented scripting language
- ruby2.3: Object-oriented scripting language

Details:

It was discovered that the Ruby CGI gem incorrectly handled parsing certain
cookies. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service. (CVE-2025-27219)

It was discovered that the Ruby CGI gem incorrectly handled parsing certain
regular expressions. A remote attacker could possibly use this issue to
consume resources, leading to a denial of service. (CVE-2025-27220)

It was discovered that the Ruby URI gem incorrectly handled certain URI
handling methods. A remote attacker could possibly use this issue to leak
authentication credentials. (CVE-2025-27221)

It was discovered that the Ruby REXML gem incorrectly handled parsing XML
documents containing many digits in a hex numeric character reference. A
remote attacker could use this issue to consume resources, leading to a
denial of service. (CVE-2024-49761)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
  libruby2.5                      2.5.1-1ubuntu1.16+esm4
                                  Available with Ubuntu Pro
  ruby2.5                         2.5.1-1ubuntu1.16+esm4
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libruby2.3                      2.3.1-2~ubuntu16.04.16+esm10
                                  Available with Ubuntu Pro
  ruby2.3                         2.3.1-2~ubuntu16.04.16+esm10
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7442-1
  CVE-2024-49761, CVE-2025-27219, CVE-2025-27220, CVE-2025-27221