Threats affecting pkg:rpm/redhat/ruby

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: Denial of Service in resolv gem (CVE-2025-24294) * rexml: REXML denial of service (CVE-2025-58767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Two security vulnerabilities were identified in Ruby's CGI module: a Regular Expression Denial of Service (ReDoS) in CGI::Util#escapeElement (CVE-2025-27220) and a Denial of Service in CGI::Cookie.parse (CVE-2025-27219). These issues could allow an attacker to cause denial of service conditions. Red Hat has released security updates addressing these vulnerabilities in Ruby packages for Red Hat Enterprise Linux 9 and related products. The update is rated as having moderate security impact. Users of affected Red Hat Enterprise Linux 9 versions should apply the provided patches to remediate these issues.