[El-errata] ELSA-2026-73519 Important: Oracle Linux 8 ruby:2.5 security update

Errata Announcements for Oracle Linux el-errata at oss.oracle.com
Fri Oct 9 18:25:32 UTC 2026 

Oracle Linux Security Advisory ELSA-2026-73519

http://linux.oracle.com/errata/ELSA-2026-73519.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
ruby-2.5.9-114.module+el8.10.0+91057+c9074c35.i686.rpm
ruby-2.5.9-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
ruby-devel-2.5.9-114.module+el8.10.0+91057+c9074c35.i686.rpm
ruby-devel-2.5.9-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
ruby-doc-2.5.9-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-abrt-0.3.0-4.module+el8.10.0+90367+ae9e8511.noarch.rpm
rubygem-abrt-doc-0.3.0-4.module+el8.10.0+90367+ae9e8511.noarch.rpm
rubygem-bigdecimal-1.3.4-114.module+el8.10.0+91057+c9074c35.i686.rpm
rubygem-bigdecimal-1.3.4-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
rubygem-bson-4.3.0-2.module+el8.9.0+90042+a65659a6.x86_64.rpm
rubygem-bson-doc-4.3.0-2.module+el8.9.0+90042+a65659a6.noarch.rpm
rubygem-bundler-1.16.1-5.module+el8.10.0+90940+f98fa8f0.noarch.rpm
rubygem-bundler-doc-1.16.1-5.module+el8.10.0+90940+f98fa8f0.noarch.rpm
rubygem-did_you_mean-1.2.0-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-io-console-0.4.6-114.module+el8.10.0+91057+c9074c35.i686.rpm
rubygem-io-console-0.4.6-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
rubygem-json-2.1.0-114.module+el8.10.0+91057+c9074c35.i686.rpm
rubygem-json-2.1.0-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
rubygem-minitest-5.10.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-mongo-2.5.1-3.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-mongo-doc-2.5.1-3.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-mysql2-0.4.10-4.module+el8.9.0+90042+a65659a6.x86_64.rpm
rubygem-mysql2-doc-0.4.10-4.module+el8.9.0+90042+a65659a6.noarch.rpm
rubygem-net-telnet-0.1.1-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-openssl-2.1.2-114.module+el8.10.0+91057+c9074c35.i686.rpm
rubygem-openssl-2.1.2-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
rubygem-pg-1.0.0-3.module+el8.9.0+90042+a65659a6.x86_64.rpm
rubygem-pg-doc-1.0.0-3.module+el8.9.0+90042+a65659a6.noarch.rpm
rubygem-power_assert-1.1.1-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-psych-3.0.2-114.module+el8.10.0+91057+c9074c35.i686.rpm
rubygem-psych-3.0.2-114.module+el8.10.0+91057+c9074c35.x86_64.rpm
rubygem-rake-12.3.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-rdoc-6.0.1.1-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygems-2.7.6.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygems-devel-2.7.6.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-test-unit-3.2.7-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-xmlrpc-0.3.0-114.module+el8.10.0+91057+c9074c35.noarch.rpm
ruby-irb-2.5.9-114.module+el8.10.0+91057+c9074c35.noarch.rpm
ruby-libs-2.5.9-114.module+el8.10.0+91057+c9074c35.i686.rpm
ruby-libs-2.5.9-114.module+el8.10.0+91057+c9074c35.x86_64.rpm

aarch64:
ruby-2.5.9-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
ruby-devel-2.5.9-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
ruby-doc-2.5.9-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-abrt-0.3.0-4.module+el8.10.0+90367+ae9e8511.noarch.rpm
rubygem-abrt-doc-0.3.0-4.module+el8.10.0+90367+ae9e8511.noarch.rpm
rubygem-bigdecimal-1.3.4-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
rubygem-bson-4.3.0-2.module+el8.9.0+90042+a65659a6.aarch64.rpm
rubygem-bson-doc-4.3.0-2.module+el8.9.0+90042+a65659a6.noarch.rpm
rubygem-bundler-1.16.1-5.module+el8.10.0+90940+f98fa8f0.noarch.rpm
rubygem-bundler-doc-1.16.1-5.module+el8.10.0+90940+f98fa8f0.noarch.rpm
rubygem-did_you_mean-1.2.0-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-io-console-0.4.6-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
rubygem-json-2.1.0-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
rubygem-minitest-5.10.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-mongo-2.5.1-3.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-mongo-doc-2.5.1-3.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-mysql2-0.4.10-4.module+el8.9.0+90042+a65659a6.aarch64.rpm
rubygem-mysql2-doc-0.4.10-4.module+el8.9.0+90042+a65659a6.noarch.rpm
rubygem-net-telnet-0.1.1-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-openssl-2.1.2-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
rubygem-pg-1.0.0-3.module+el8.9.0+90042+a65659a6.aarch64.rpm
rubygem-pg-doc-1.0.0-3.module+el8.9.0+90042+a65659a6.noarch.rpm
rubygem-power_assert-1.1.1-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-psych-3.0.2-114.module+el8.10.0+91057+c9074c35.aarch64.rpm
rubygem-rake-12.3.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-rdoc-6.0.1.1-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygems-2.7.6.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygems-devel-2.7.6.3-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-test-unit-3.2.7-114.module+el8.10.0+91057+c9074c35.noarch.rpm
rubygem-xmlrpc-0.3.0-114.module+el8.10.0+91057+c9074c35.noarch.rpm
ruby-irb-2.5.9-114.module+el8.10.0+91057+c9074c35.noarch.rpm
ruby-libs-2.5.9-114.module+el8.10.0+91057+c9074c35.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/ruby-2.5.9-114.module+el8.10.0+91057+c9074c35.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/rubygem-abrt-0.3.0-4.module+el8.10.0+90367+ae9e8511.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/rubygem-bson-4.3.0-2.module+el8.9.0+90042+a65659a6.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/rubygem-bundler-1.16.1-5.module+el8.10.0+90940+f98fa8f0.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/rubygem-mongo-2.5.1-3.module+el8.10.0+91057+c9074c35.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/rubygem-mysql2-0.4.10-4.module+el8.9.0+90042+a65659a6.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/rubygem-pg-1.0.0-3.module+el8.9.0+90042+a65659a6.src.rpm

Related CVEs:

CVE-2026-80212
CVE-2026-88030




Description of changes:

ruby
[2.5.9-114]
- Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012).
  Resolves: RHEL-87505

[2.5.9-113]
- Fix REXML ReDoS vulnerability. (CVE-2024-49761)
  Resolves: RHEL-68515

[2.5.9-112]
- Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755.
  (CVE-2023-36617)
  Resolves: RHEL-5614
- Fix Buffer overread vulnerability in StringIO.
  (CVE-2024-27280)
  Resolves: RHEL-34125
- Fix RCE vulnerability with .rdoc_options in RDoc.
  (CVE-2024-27281)
  Resolves: RHEL-34117
- Fix Arbitrary memory address read vulnerability with Regex search.
  (CVE-2024-27282)
  Resolves: RHEL-33867
- Fix REXML DoS parsing an XML with many <s in an attribute value.
  (CVE-2024-35176)
  Resolves: RHEL-37877

[2.5.9-111]
- Fix HTTP response splitting in CGI.
  Resolves: CVE-2021-33621
- Fix Buffer overrun in String-to-Float conversion.
  Resolves: CVE-2022-28739
- Fix ReDoS vulnerability in URI.
  Resolves: CVE-2023-28755
- Fix ReDoS vulnerability in Time.
  Resolves: CVE-2023-28756

[2.5.9-111]
- Fix rdoc parsing of nil text tokens.
  Resolves: rhbz#2210326

[2.5.9-110]
- Fix FTBFS due to an incompatible load directive.
- Fix a fiddle import test on an optimized glibc on Power 9.
- Fix by adding length limit option for methods that parses date strings.
  Resolves: CVE-2021-41817
- CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security
  prefixes in cookie names.
  Resolves: CVE-2021-41819

[2.5.9-109]
- Properly fix command injection vulnerability in Rdoc.
  Related: CVE-2021-31799

[2.5.9-108]
- Fix command injection vulnerability in RDoc.
  Resolves: CVE-2021-31799
- Fix StartTLS stripping vulnerability in Net::IMAP
  Resolves: CVE-2021-32066
- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
  Resolves: CVE-2021-31810

[2.5.9-107]
- Update to Ruby 2.5.9.
  * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
  Resolves: rhbz#1757844
- Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
  contains leading zero
  Resolves: rhbz#1950308

[2.5.5-106]
- Remove file with non-commercial license from did_you_mean gem.
  Resolves: rhbz#1846113

rubygem-abrt
[0.3.0-4]
- Execute test suite unconditionally.
- Upload correct sources.

[0.3.0-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[0.3.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[0.3.0-1]
- Update to abrt 0.3.0.

[0.2.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[0.2.0-1]
- Update to abrt 0.2.0.

[0.1.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[0.1.1-1]
- Update to abrt 0.1.1.

[0.0.6-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[0.0.6-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

rubygem-bson
[4.3.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[4.3.0-1]
- Update to bson 4.3.0.
- Remove Obsoletes (rhbz#1537219)

[4.2.2-3]
- Rebuilt for switch to libxcrypt

[4.2.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.5

[4.2.2-1]
- Update to bson 4.2.2.

[4.2.1-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[4.2.1-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[4.2.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[4.2.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.4

[4.2.1-1]
- Update to bson 4.2.1.

rubygem-bundler
[1.16.1-5]
- Fix unexpected code execution in Gemfiles (CVE-2021-43809)
  Resolves: RHEL-87017

[1.16.1-4]
- Fix Bundler dependency confusion.
  Resolves: CVE-2020-36327

[1.16.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.16.1-2]
- Remove unnecessary executable bit.

[1.16.1-1]
- Update to Bundler 1.16.1.

[1.16.0-1]
- Update to Bundler 1.16.0.

[1.13.7-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.13.7-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[1.13.7-1]
- Update to Bundler 1.13.7.

[1.13.6-1]
- Update to Bundler 1.13.6.

rubygem-mongo
[2.5.1-3]
- Fix Data disclosure and denial of service via query-operator injection.
  (CVE-2026-88030)
  Resolves: RHEL-259675

[2.5.1-2]
- Disable tests to fix FTBFS by dropped MongoDB module.
  Resolves: rhbz#1710863

[2.5.1-1]
- Update to mongo 2.5.1.

[2.5.0-1]
- Update to mongo 2.5.0.

[2.4.3-2]
- Escape macros in %changelog

[2.4.3-1]
- Update to mongo 2.4.3.

[2.4.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.4.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.4.1-1]
- Update to mongo 2.4.1.

[2.4.0-1]
- Update to mongo 2.4.0.

rubygem-mysql2
[0.4.10-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[0.4.10-3]
- Rebuilt for switch to libxcrypt

[0.4.10-2]
- F-28: rebuild for ruby25

[0.4.10-1]
- New upstream release 0.4.10

[0.4.8-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[0.4.8-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[0.4.8-1]
- New upstream release 0.4.8 (builds against MariaDB 10.2)

[0.4.4-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[0.4.4-2]
- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.4

[0.4.4-1]
- New upstream release 0.4.4

rubygem-pg
[1.0.0-3]
- Fix FTBFS with PostgreSQL 10.6 and above.

[1.0.0-2]
- Assign a random testing port.

[1.0.0-1]
- Update to pg 1.0.0.

[0.21.0-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[0.21.0-4]
- Rebuilt for switch to libxcrypt

[0.21.0-3]
- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.5

[0.21.0-2]
- Fix failed tests for PostgreSQL-10.

[0.21.0-1]
- Update to pg 0.21.0.

[0.20.0-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[0.20.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

More information about the El-errata mailing list