ruby:2.5 security update

An update is available for rubygem-abrt, module.rubygem-bundler, module.rubygem-bson, ruby, rubygem-mysql2, module.rubygem-abrt, rubygem-pg, module.rubygem-mongo, module.rubygem-pg, module.rubygem-mysql2, rubygem-bson, module.ruby, rubygem-mongo, rubygem-bundler. This update affects Rocky Linux 8...

PT-2026-103918

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description OS command injection flaws exist in the foreman-rake db:dump and db:import dump tasks. The application does not properly sanitize user-supplied input in the destination parameter during backu...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2025_7539)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257539 advisory. oniguruma: integer overflow in searchinrange function in regexec.c leads to out-of-bounds read CVE-2019-19012 rubygem-bundler: unexpected code execution in...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc (crlsa-2026_20614)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202620614 advisory. erb: ERB: Arbitrary code execution via deserialization bypass CVE-2026-41316 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc (crlsa-2024_10834)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202410834 advisory. rexml: REXML ReDoS vulnerability CVE-2024-49761 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has...

Rocky Linux 9 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_20596)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620596 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc (CENTOS7:CLSA-2025:1757699919)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1757699919 advisory. - An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument functio...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_50728)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202650728 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Rocky Linux 9 [CIQ] Security Update: rubygem-mysql2 / rubygem-mysql2-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3668)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243668 advisory. ruby: Buffer overread vulnerability in StringIO CVE-2024-27280 ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc (CENTOS7:CLSA-2025:1758023679)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1758023679 advisory. - An exploitable heap overflow vulnerability exists in the Fiddle::Function.new initialize function functionality of Ruby. In Fiddle::Function.ne...

Rocky Linux 10.1 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23141)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523141 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description...

AlmaLinux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1781100836)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781100836 advisory. - ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard ...

Rocky Linux 9.2 [CIQ] Security Update: rubygem-bigdecimal / rubygem-bigdecimal-debuginfo (ciqsa-2026_1285)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261285 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2022_0543)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20220543 advisory. rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source CVE-2020-36327 rubygem-rdoc: Command injection...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2022_5779)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225779 advisory. ruby: Regular expression denial of service vulnerability of Date parsing methods CVE-2021-41817 ruby: Cookie prefix spoofing in CGI::Cookie.parse...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777444043)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777444043 advisory. - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1759222758)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1759222758 advisory. - Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as retval...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc (CENTOS7:CLSA-2026:1786470325)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786470325 advisory. - zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buff...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-default-gems / etc Multiple Vulnerabilities (crlsa-2021_3020)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213020 advisory. rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source CVE-2020-36327 rubygem-rdoc: Command injection...

Rocky Linux 10.2 [CIQ] Security Update: ruby4.0 / ruby4.0-debuginfo / ruby4.0-debugsource / ruby4.0-devel / etc Multiple Vulnerabilities (crlsa-2026_20606)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620606 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...