CVE-2025-0306
Fixed in a distro release EPSS <1%CVSS 7.4
A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Storage 3
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | ruby-3.2 | 0 |
| Chainguard | ruby-3.2-base | 0 |
| Chainguard | ruby-3.2-base-dev | 0 |
| Chainguard | ruby-3.2-dev | 0 |
| Chainguard | ruby-3.2-doc | 0 |
| Debian 12 | ruby3.1 | no fix |
| Ubuntu 20.04 LTS | jruby | no fix |
| Ubuntu 20.04 LTS | ruby2.7 | no fix |
| Ubuntu 22.04 LTS | ruby3.0 | no fix |
| Ubuntu 24.04 LTS | jruby | no fix |
| Ubuntu 24.04 LTS | ruby3.2 | no fix |
| Ubuntu 24.10 | jruby | no fix |
| Ubuntu 24.10 | ruby3.3 | no fix |
| Ubuntu Pro 14.04 LTS | jruby | no fix |
| Ubuntu Pro 16.04 LTS | jruby | no fix |
| Ubuntu Pro 16.04 LTS | ruby2.3 | no fix |
| Ubuntu Pro 18.04 LTS | jruby | no fix |
| Ubuntu Pro 18.04 LTS | ruby2.5 | no fix |
| Wolfi | ruby-3.2 | 0 |
| Wolfi | ruby-3.2-base | 0 |
| Wolfi | ruby-3.2-base-dev | 0 |
| Wolfi | ruby-3.2-dev | 0 |
| Wolfi | ruby-3.2-doc | 0 |