Threats Tagged 'cve-2026-41316'

This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.6-37.2.hum1 (noarch) * ruby4.0-devel-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.6-37.2.hum1 (noarch) * ruby4.0-libs-4.0.6-37.2.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.16-37.2.hum1 (noarch) * rubygem4.0-devel-4.0.16-37.2.hum1 (noarch) * rubygem4.0-io-console-0.8.2-37.2.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-37.2.hum1 (noarch) * rubygem4.0-json-2.18.0-37.2.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-37.2.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-37.2.hum1 (noarch) * rubygem4.0-psych-5.3.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-37.2.hum1 (noarch) * rubygem4.0-rbs-3.10.0-37.2.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.4-37.2.hum1 (noarch) * rubygem4.0-rexml-3.4.4-37.2.hum1 (noarch) * rubygem4.0-rss-0.3.2-37.2.hum1 (noarch) * rubygem4.0-rubygems-4.0.16-37.2.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-37.2.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-37.2.hum1 (noarch) * ruby4.0-4.0.6-37.2.hum1.src (src) Security Fix(es): ruby4.0: * CVE-2026-33210

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.