USN-7735-1

It was discovered that RubyGems incorrectly handled certain regular expressions. An attacker could use this issue to cause RubyGems to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-28755)

It was discovered that RubyGems incorrectly handled decompressed domain names within a DNS packet. An attacker could use this issue to cause RubyGems to crash, resulting in a denial of service. This issue only affected Ubuntu 25.04. (CVE-2025-24294)

References

Affected packages

Ubuntu:22.04:LTS / rubygems

Package

Name: rubygems
Purl: pkg:deb/ubuntu/rubygems@3.3.5-2ubuntu1.1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3.5-2ubuntu1.1

Affected versions

3.*

3.2.5-2

3.2.27-2

3.2.27-3

3.3.5-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.3.5-2ubuntu1.1",
            "binary_name": "bundler"
        },
        {
            "binary_version": "2.3.5-2ubuntu1.1",
            "binary_name": "ruby-bundler"
        },
        {
            "binary_version": "3.3.5-2ubuntu1.1",
            "binary_name": "ruby-rubygems"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:25.04 / rubygems

Package

Name: rubygems
Purl: pkg:deb/ubuntu/rubygems@3.6.3-1ubuntu0.1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.3-1ubuntu0.1

Affected versions

3.*

3.4.20-1

3.6.3-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.6.3-1ubuntu0.1",
            "binary_name": "bundler"
        },
        {
            "binary_version": "2.6.3-1ubuntu0.1",
            "binary_name": "ruby-bundler"
        },
        {
            "binary_version": "3.6.3-1ubuntu0.1",
            "binary_name": "ruby-rubygems"
        }
    ],
    "availability": "No subscription required"
}