Описание
ELSA-2026-18065: ruby security update (IMPORTANT)
[3.3.10-12]
- Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171244
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
ruby
3.3.10-12.el10_1
ruby-bundled-gems
3.3.10-12.el10_1
ruby-default-gems
3.3.10-12.el10_1
ruby-devel
3.3.10-12.el10_1
ruby-libs
3.3.10-12.el10_1
rubygem-bigdecimal
3.1.5-12.el10_1
rubygem-bundler
2.5.22-12.el10_1
rubygem-io-console
0.7.1-12.el10_1
rubygem-irb
1.13.1-12.el10_1
rubygem-json
2.7.2-12.el10_1
rubygem-minitest
5.20.0-12.el10_1
rubygem-power_assert
2.0.3-12.el10_1
rubygem-psych
5.1.2-12.el10_1
rubygem-racc
1.7.3-12.el10_1
rubygem-rake
13.1.0-12.el10_1
rubygem-rbs
3.4.0-12.el10_1
rubygem-rdoc
6.6.3.1-12.el10_1
rubygem-rexml
3.4.4-12.el10_1
rubygem-rss
0.3.1-12.el10_1
rubygem-test-unit
3.6.1-12.el10_1
rubygem-typeprof
0.21.9-12.el10_1
rubygems
3.5.22-12.el10_1
rubygems-devel
3.5.22-12.el10_1
ruby-doc
3.3.10-12.el10_1
Oracle Linux x86_64
ruby
3.3.10-12.el10_1
ruby-bundled-gems
3.3.10-12.el10_1
ruby-default-gems
3.3.10-12.el10_1
ruby-devel
3.3.10-12.el10_1
ruby-libs
3.3.10-12.el10_1
rubygem-bigdecimal
3.1.5-12.el10_1
rubygem-bundler
2.5.22-12.el10_1
rubygem-io-console
0.7.1-12.el10_1
rubygem-irb
1.13.1-12.el10_1
rubygem-json
2.7.2-12.el10_1
rubygem-minitest
5.20.0-12.el10_1
rubygem-power_assert
2.0.3-12.el10_1
rubygem-psych
5.1.2-12.el10_1
rubygem-racc
1.7.3-12.el10_1
rubygem-rake
13.1.0-12.el10_1
rubygem-rbs
3.4.0-12.el10_1
rubygem-rdoc
6.6.3.1-12.el10_1
rubygem-rexml
3.4.4-12.el10_1
rubygem-rss
0.3.1-12.el10_1
rubygem-test-unit
3.6.1-12.el10_1
rubygem-typeprof
0.21.9-12.el10_1
rubygems
3.5.22-12.el10_1
rubygems-devel
3.5.22-12.el10_1
ruby-doc
3.3.10-12.el10_1
Связанные CVE
Связанные уязвимости
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was ...
