Moderate Security Update for Ruby: Addressing Multiple REXML and CGI Vulnerabilities
Summary
ALSA-2025:4488: Moderate: ruby:3.1 security update. Affects rubygem-mysql2 versions < 0.5.4-1.module_el9.1.0+8+503f6fbd. Fixed in 0.5.4-1.module_el9.1.0+8+503f6fbd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management tasks. It features a rich set of libraries and frameworks, making it a popular choice among developers. However, recent vulnerabilities have been identified in its REXML and CGI components, which could lead to denial of service (DoS) attacks and potential information leakage.
Vulnerability Detail
The vulnerabilities primarily affect the REXML library, which is responsible for XML parsing in Ruby. Specific issues include denial of service (DoS) vulnerabilities when parsing XML documents with certain characters, as well as a regular expression denial of service (ReDoS) in CGI utilities. These vulnerabilities can be exploited by attackers to cause significant disruptions in service or to leak sensitive information.
How To Fix
Minimum fixed version
0.5.4-1.module_el9.1.0+8+503f6fbd
This is the first release that contains the fix.
sudo dnf update rubygem-mysql2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, avoid processing untrusted XML data until the vulnerabilities are resolved.
Conclusion
The recent security update for Ruby addresses multiple vulnerabilities in the REXML and CGI components that could lead to denial of service and information leakage. It is crucial for users to update their packages to the patched versions to ensure the security and stability of their applications.
See every vulnerability recorded for rubygem-mysql2 →
FAQ
REXML is a Ruby library used for parsing and manipulating XML documents. It is part of the standard library in Ruby.
Exploitation of these vulnerabilities can lead to denial of service attacks, causing applications to become unresponsive, or leaking sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Implement input validation and sanitization as a temporary measure to reduce the risk of exploitation until you can apply the updates.
Detailed information about the vulnerabilities can be found on the respective CVE pages listed in the security update.
Related vulnerabilities
Recent vulnerabilities recorded for rubygem-mysql2.
