Описание
ELSA-2026-18039: ruby security update (IMPORTANT)
[3.0.7-166]
- Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171254
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
ruby-doc
3.0.7-166.el9_7
ruby
3.0.7-166.el9_7
ruby-default-gems
3.0.7-166.el9_7
ruby-devel
3.0.7-166.el9_7
ruby-libs
3.0.7-166.el9_7
rubygem-bigdecimal
3.0.0-166.el9_7
rubygem-bundler
2.2.33-166.el9_7
rubygem-io-console
0.5.7-166.el9_7
rubygem-irb
1.3.5-166.el9_7
rubygem-json
2.5.1-166.el9_7
rubygem-minitest
5.14.2-166.el9_7
rubygem-power_assert
1.2.1-166.el9_7
rubygem-psych
3.3.2-166.el9_7
rubygem-rake
13.0.3-166.el9_7
rubygem-rbs
1.4.0-166.el9_7
rubygem-rdoc
6.3.4.1-166.el9_7
rubygem-rexml
3.2.5-166.el9_7
rubygem-rss
0.2.9-166.el9_7
rubygem-test-unit
3.3.7-166.el9_7
rubygem-typeprof
0.15.2-166.el9_7
rubygems
3.2.33-166.el9_7
rubygems-devel
3.2.33-166.el9_7
Oracle Linux x86_64
ruby
3.0.7-166.el9_7
ruby-default-gems
3.0.7-166.el9_7
ruby-devel
3.0.7-166.el9_7
ruby-libs
3.0.7-166.el9_7
rubygem-bigdecimal
3.0.0-166.el9_7
rubygem-bundler
2.2.33-166.el9_7
rubygem-io-console
0.5.7-166.el9_7
rubygem-irb
1.3.5-166.el9_7
rubygem-json
2.5.1-166.el9_7
rubygem-minitest
5.14.2-166.el9_7
rubygem-power_assert
1.2.1-166.el9_7
rubygem-psych
3.3.2-166.el9_7
rubygem-rake
13.0.3-166.el9_7
rubygem-rbs
1.4.0-166.el9_7
rubygem-rdoc
6.3.4.1-166.el9_7
rubygem-rexml
3.2.5-166.el9_7
rubygem-rss
0.2.9-166.el9_7
rubygem-test-unit
3.3.7-166.el9_7
rubygem-typeprof
0.15.2-166.el9_7
rubygems
3.2.33-166.el9_7
rubygems-devel
3.2.33-166.el9_7
ruby-doc
3.0.7-166.el9_7
Связанные CVE
Связанные уязвимости
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was ...
