An update for ruby is now available for openEuler-22.03-LTS-SP3,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-2655 Final 1.0 1.0 2025-11-14 Initial 2025-11-14 2025-11-14 openEuler SA Tool V1.0 2025-11-14 ruby security update An update for ruby is now available for openEuler-22.03-LTS-SP3,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-20.03-LTS-SP4 Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es): REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.(CVE-2025-58767) Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the use of the `+` operator when combining URIs. An attacker can obtain sensitive user credentials by crafting a URI that, when merged with another, results in the unintended exposure of authentication information. **Note:** This vulnerability is a bypass of the fix to CVE-2025-27221.(CVE-2025-61594) An update for ruby is now available for openEuler-22.03-LTS-SP3,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium ruby https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2655 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-58767 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-61594 https://nvd.nist.gov/vuln/detail/CVE-2025-58767 https://nvd.nist.gov/vuln/detail/CVE-2025-61594 openEuler-22.03-LTS-SP3 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-20.03-LTS-SP4 ruby-3.0.3-144.oe2203sp3.aarch64.rpm ruby-debuginfo-3.0.3-144.oe2203sp3.aarch64.rpm ruby-debugsource-3.0.3-144.oe2203sp3.aarch64.rpm ruby-devel-3.0.3-144.oe2203sp3.aarch64.rpm rubygem-bigdecimal-3.0.0-144.oe2203sp3.aarch64.rpm rubygem-io-console-0.5.7-144.oe2203sp3.aarch64.rpm rubygem-json-2.5.1-144.oe2203sp3.aarch64.rpm rubygem-openssl-2.2.1-144.oe2203sp3.aarch64.rpm rubygem-psych-3.3.2-144.oe2203sp3.aarch64.rpm ruby-3.0.3-144.oe2203sp4.aarch64.rpm ruby-debuginfo-3.0.3-144.oe2203sp4.aarch64.rpm ruby-debugsource-3.0.3-144.oe2203sp4.aarch64.rpm ruby-devel-3.0.3-144.oe2203sp4.aarch64.rpm rubygem-bigdecimal-3.0.0-144.oe2203sp4.aarch64.rpm rubygem-io-console-0.5.7-144.oe2203sp4.aarch64.rpm rubygem-json-2.5.1-144.oe2203sp4.aarch64.rpm rubygem-openssl-2.2.1-144.oe2203sp4.aarch64.rpm rubygem-psych-3.3.2-144.oe2203sp4.aarch64.rpm ruby-3.2.2-151.oe2403.aarch64.rpm ruby-bundled-gems-3.2.2-151.oe2403.aarch64.rpm ruby-debuginfo-3.2.2-151.oe2403.aarch64.rpm ruby-debugsource-3.2.2-151.oe2403.aarch64.rpm ruby-devel-3.2.2-151.oe2403.aarch64.rpm rubygem-bigdecimal-3.1.3-151.oe2403.aarch64.rpm rubygem-io-console-0.6.0-151.oe2403.aarch64.rpm rubygem-json-2.6.3-151.oe2403.aarch64.rpm rubygem-openssl-3.1.0-151.oe2403.aarch64.rpm rubygem-psych-5.0.1-151.oe2403.aarch64.rpm rubygem-rbs-2.8.2-151.oe2403.aarch64.rpm ruby-3.2.2-151.oe2403sp1.aarch64.rpm ruby-bundled-gems-3.2.2-151.oe2403sp1.aarch64.rpm ruby-debuginfo-3.2.2-151.oe2403sp1.aarch64.rpm ruby-debugsource-3.2.2-151.oe2403sp1.aarch64.rpm ruby-devel-3.2.2-151.oe2403sp1.aarch64.rpm rubygem-bigdecimal-3.1.3-151.oe2403sp1.aarch64.rpm rubygem-io-console-0.6.0-151.oe2403sp1.aarch64.rpm rubygem-json-2.6.3-151.oe2403sp1.aarch64.rpm rubygem-openssl-3.1.0-151.oe2403sp1.aarch64.rpm rubygem-psych-5.0.1-151.oe2403sp1.aarch64.rpm rubygem-rbs-2.8.2-151.oe2403sp1.aarch64.rpm ruby-3.2.2-151.oe2403sp2.aarch64.rpm ruby-bundled-gems-3.2.2-151.oe2403sp2.aarch64.rpm ruby-debuginfo-3.2.2-151.oe2403sp2.aarch64.rpm ruby-debugsource-3.2.2-151.oe2403sp2.aarch64.rpm ruby-devel-3.2.2-151.oe2403sp2.aarch64.rpm rubygem-bigdecimal-3.1.3-151.oe2403sp2.aarch64.rpm rubygem-io-console-0.6.0-151.oe2403sp2.aarch64.rpm rubygem-json-2.6.3-151.oe2403sp2.aarch64.rpm rubygem-openssl-3.1.0-151.oe2403sp2.aarch64.rpm rubygem-psych-5.0.1-151.oe2403sp2.aarch64.rpm rubygem-rbs-2.8.2-151.oe2403sp2.aarch64.rpm ruby-2.5.8-136.oe2003sp4.aarch64.rpm ruby-debuginfo-2.5.8-136.oe2003sp4.aarch64.rpm ruby-debugsource-2.5.8-136.oe2003sp4.aarch64.rpm ruby-devel-2.5.8-136.oe2003sp4.aarch64.rpm rubygem-bigdecimal-1.3.4-136.oe2003sp4.aarch64.rpm rubygem-io-console-0.4.6-136.oe2003sp4.aarch64.rpm rubygem-json-2.1.0-136.oe2003sp4.aarch64.rpm rubygem-openssl-2.1.2-136.oe2003sp4.aarch64.rpm rubygem-psych-3.0.2-136.oe2003sp4.aarch64.rpm ruby-3.0.3-144.oe2203sp3.src.rpm ruby-3.0.3-144.oe2203sp4.src.rpm ruby-3.2.2-151.oe2403.src.rpm ruby-3.2.2-151.oe2403sp1.src.rpm ruby-3.2.2-151.oe2403sp2.src.rpm ruby-2.5.8-136.oe2003sp4.src.rpm ruby-3.0.3-144.oe2203sp3.x86_64.rpm ruby-debuginfo-3.0.3-144.oe2203sp3.x86_64.rpm ruby-debugsource-3.0.3-144.oe2203sp3.x86_64.rpm ruby-devel-3.0.3-144.oe2203sp3.x86_64.rpm rubygem-bigdecimal-3.0.0-144.oe2203sp3.x86_64.rpm rubygem-io-console-0.5.7-144.oe2203sp3.x86_64.rpm rubygem-json-2.5.1-144.oe2203sp3.x86_64.rpm rubygem-openssl-2.2.1-144.oe2203sp3.x86_64.rpm rubygem-psych-3.3.2-144.oe2203sp3.x86_64.rpm ruby-3.0.3-144.oe2203sp4.x86_64.rpm ruby-debuginfo-3.0.3-144.oe2203sp4.x86_64.rpm ruby-debugsource-3.0.3-144.oe2203sp4.x86_64.rpm ruby-devel-3.0.3-144.oe2203sp4.x86_64.rpm rubygem-bigdecimal-3.0.0-144.oe2203sp4.x86_64.rpm rubygem-io-console-0.5.7-144.oe2203sp4.x86_64.rpm rubygem-json-2.5.1-144.oe2203sp4.x86_64.rpm rubygem-openssl-2.2.1-144.oe2203sp4.x86_64.rpm rubygem-psych-3.3.2-144.oe2203sp4.x86_64.rpm ruby-3.2.2-151.oe2403.x86_64.rpm ruby-bundled-gems-3.2.2-151.oe2403.x86_64.rpm ruby-debuginfo-3.2.2-151.oe2403.x86_64.rpm ruby-debugsource-3.2.2-151.oe2403.x86_64.rpm ruby-devel-3.2.2-151.oe2403.x86_64.rpm rubygem-bigdecimal-3.1.3-151.oe2403.x86_64.rpm rubygem-io-console-0.6.0-151.oe2403.x86_64.rpm rubygem-json-2.6.3-151.oe2403.x86_64.rpm rubygem-openssl-3.1.0-151.oe2403.x86_64.rpm rubygem-psych-5.0.1-151.oe2403.x86_64.rpm rubygem-rbs-2.8.2-151.oe2403.x86_64.rpm ruby-3.2.2-151.oe2403sp1.x86_64.rpm ruby-bundled-gems-3.2.2-151.oe2403sp1.x86_64.rpm ruby-debuginfo-3.2.2-151.oe2403sp1.x86_64.rpm ruby-debugsource-3.2.2-151.oe2403sp1.x86_64.rpm ruby-devel-3.2.2-151.oe2403sp1.x86_64.rpm rubygem-bigdecimal-3.1.3-151.oe2403sp1.x86_64.rpm rubygem-io-console-0.6.0-151.oe2403sp1.x86_64.rpm rubygem-json-2.6.3-151.oe2403sp1.x86_64.rpm rubygem-openssl-3.1.0-151.oe2403sp1.x86_64.rpm rubygem-psych-5.0.1-151.oe2403sp1.x86_64.rpm rubygem-rbs-2.8.2-151.oe2403sp1.x86_64.rpm ruby-3.2.2-151.oe2403sp2.x86_64.rpm ruby-bundled-gems-3.2.2-151.oe2403sp2.x86_64.rpm ruby-debuginfo-3.2.2-151.oe2403sp2.x86_64.rpm ruby-debugsource-3.2.2-151.oe2403sp2.x86_64.rpm ruby-devel-3.2.2-151.oe2403sp2.x86_64.rpm rubygem-bigdecimal-3.1.3-151.oe2403sp2.x86_64.rpm rubygem-io-console-0.6.0-151.oe2403sp2.x86_64.rpm rubygem-json-2.6.3-151.oe2403sp2.x86_64.rpm rubygem-openssl-3.1.0-151.oe2403sp2.x86_64.rpm rubygem-psych-5.0.1-151.oe2403sp2.x86_64.rpm rubygem-rbs-2.8.2-151.oe2403sp2.x86_64.rpm ruby-2.5.8-136.oe2003sp4.x86_64.rpm ruby-debuginfo-2.5.8-136.oe2003sp4.x86_64.rpm ruby-debugsource-2.5.8-136.oe2003sp4.x86_64.rpm ruby-devel-2.5.8-136.oe2003sp4.x86_64.rpm rubygem-bigdecimal-1.3.4-136.oe2003sp4.x86_64.rpm rubygem-io-console-0.4.6-136.oe2003sp4.x86_64.rpm rubygem-json-2.1.0-136.oe2003sp4.x86_64.rpm rubygem-openssl-2.1.2-136.oe2003sp4.x86_64.rpm rubygem-psych-3.0.2-136.oe2003sp4.x86_64.rpm ruby-help-3.0.3-144.oe2203sp3.noarch.rpm ruby-irb-3.0.3-144.oe2203sp3.noarch.rpm rubygem-bundler-2.2.32-144.oe2203sp3.noarch.rpm rubygem-did_you_mean-1.5.0-144.oe2203sp3.noarch.rpm rubygem-minitest-5.14.2-144.oe2203sp3.noarch.rpm rubygem-rake-13.0.3-144.oe2203sp3.noarch.rpm rubygem-rbs-1.4.0-144.oe2203sp3.noarch.rpm rubygem-rdoc-6.3.3-144.oe2203sp3.noarch.rpm rubygem-rexml-3.2.5-144.oe2203sp3.noarch.rpm rubygem-rss-0.2.9-144.oe2203sp3.noarch.rpm rubygem-test-unit-3.3.7-144.oe2203sp3.noarch.rpm rubygem-typeprof-0.15.2-144.oe2203sp3.noarch.rpm rubygems-3.2.32-144.oe2203sp3.noarch.rpm rubygems-devel-3.2.32-144.oe2203sp3.noarch.rpm ruby-help-3.0.3-144.oe2203sp4.noarch.rpm ruby-irb-3.0.3-144.oe2203sp4.noarch.rpm rubygem-bundler-2.2.32-144.oe2203sp4.noarch.rpm rubygem-did_you_mean-1.5.0-144.oe2203sp4.noarch.rpm rubygem-minitest-5.14.2-144.oe2203sp4.noarch.rpm rubygem-rake-13.0.3-144.oe2203sp4.noarch.rpm rubygem-rbs-1.4.0-144.oe2203sp4.noarch.rpm rubygem-rdoc-6.3.3-144.oe2203sp4.noarch.rpm rubygem-rexml-3.2.5-144.oe2203sp4.noarch.rpm rubygem-rss-0.2.9-144.oe2203sp4.noarch.rpm rubygem-test-unit-3.3.7-144.oe2203sp4.noarch.rpm rubygem-typeprof-0.15.2-144.oe2203sp4.noarch.rpm rubygems-3.2.32-144.oe2203sp4.noarch.rpm rubygems-devel-3.2.32-144.oe2203sp4.noarch.rpm ruby-help-3.2.2-151.oe2403.noarch.rpm ruby-irb-3.2.2-151.oe2403.noarch.rpm rubygem-did_you_mean-1.6.3-151.oe2403.noarch.rpm rubygem-minitest-5.16.3-151.oe2403.noarch.rpm rubygem-rake-13.0.6-151.oe2403.noarch.rpm rubygem-rdoc-6.5.0-151.oe2403.noarch.rpm rubygem-rexml-3.2.5-151.oe2403.noarch.rpm rubygem-rss-0.2.9-151.oe2403.noarch.rpm rubygem-test-unit-3.5.7-151.oe2403.noarch.rpm rubygem-typeprof-0.21.3-151.oe2403.noarch.rpm rubygems-3.4.10-151.oe2403.noarch.rpm rubygems-devel-3.4.10-151.oe2403.noarch.rpm ruby-help-3.2.2-151.oe2403sp1.noarch.rpm ruby-irb-3.2.2-151.oe2403sp1.noarch.rpm rubygem-did_you_mean-1.6.3-151.oe2403sp1.noarch.rpm rubygem-minitest-5.16.3-151.oe2403sp1.noarch.rpm rubygem-rake-13.0.6-151.oe2403sp1.noarch.rpm rubygem-rdoc-6.5.0-151.oe2403sp1.noarch.rpm rubygem-rexml-3.2.5-151.oe2403sp1.noarch.rpm rubygem-rss-0.2.9-151.oe2403sp1.noarch.rpm rubygem-test-unit-3.5.7-151.oe2403sp1.noarch.rpm rubygem-typeprof-0.21.3-151.oe2403sp1.noarch.rpm rubygems-3.4.10-151.oe2403sp1.noarch.rpm rubygems-devel-3.4.10-151.oe2403sp1.noarch.rpm ruby-help-3.2.2-151.oe2403sp2.noarch.rpm ruby-irb-3.2.2-151.oe2403sp2.noarch.rpm rubygem-did_you_mean-1.6.3-151.oe2403sp2.noarch.rpm rubygem-minitest-5.16.3-151.oe2403sp2.noarch.rpm rubygem-rake-13.0.6-151.oe2403sp2.noarch.rpm rubygem-rdoc-6.5.0-151.oe2403sp2.noarch.rpm rubygem-rexml-3.2.5-151.oe2403sp2.noarch.rpm rubygem-rss-0.2.9-151.oe2403sp2.noarch.rpm rubygem-test-unit-3.5.7-151.oe2403sp2.noarch.rpm rubygem-typeprof-0.21.3-151.oe2403sp2.noarch.rpm rubygems-3.4.10-151.oe2403sp2.noarch.rpm rubygems-devel-3.4.10-151.oe2403sp2.noarch.rpm ruby-help-2.5.8-136.oe2003sp4.noarch.rpm ruby-irb-2.5.8-136.oe2003sp4.noarch.rpm rubygem-did_you_mean-1.2.0-136.oe2003sp4.noarch.rpm rubygem-minitest-5.10.3-136.oe2003sp4.noarch.rpm rubygem-net-telnet-0.1.1-136.oe2003sp4.noarch.rpm rubygem-power_assert-1.1.1-136.oe2003sp4.noarch.rpm rubygem-rake-12.3.0-136.oe2003sp4.noarch.rpm rubygem-rdoc-6.0.1.1-136.oe2003sp4.noarch.rpm rubygem-test-unit-3.2.7-136.oe2003sp4.noarch.rpm rubygem-xmlrpc-0.3.0-136.oe2003sp4.noarch.rpm rubygems-2.7.6-136.oe2003sp4.noarch.rpm rubygems-devel-2.7.6-136.oe2003sp4.noarch.rpm REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities. 2025-11-14 CVE-2025-58767 openEuler-22.03-LTS-SP3 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-20.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L ruby security update 2025-11-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2655 Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the use of the `+` operator when combining URIs. An attacker can obtain sensitive user credentials by crafting a URI that, when merged with another, results in the unintended exposure of authentication information. **Note:** This vulnerability is a bypass of the fix to CVE-2025-27221. 2025-11-14 CVE-2025-61594 openEuler-22.03-LTS-SP3 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-20.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N ruby security update 2025-11-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2655