Back Linuxsecurity

Ubuntu 25.10 Ruby Critical Sensitive Info Exposure USN-8137

Linuxsecurity •LinuxSecurity Advisories • April 1, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Ruby could be made to expose sensitive information. Software Description: - ruby3.3: Object-oriented scripting language - ruby3.2: Object-oriented scripting language - ruby3.0: Object-oriented scripting language - ruby2.7: Object-oriented scripting language - ruby2.5: Object-oriented scripting language - ruby2.3: Object-oriented scripting language Details: It was discovered that the Ruby URI gem did not properly handle sensitive information when combining URIs. A remote attacker could possibly use this issue to leak authentication credentials.

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 libruby3.3 3.3.8-2ubuntu2.1 ruby3.3 3.3.8-2ubuntu2.1 Ubuntu 24.04 LTS libruby3.2 3.2.3-1ubuntu0.24.04.7 ruby3.2 3.2.3-1ubuntu0.24.04.7 Ubuntu 22.04 LTS libruby3.0 3.0.2-7ubuntu2.12 ruby3.0 3.0.2-7ubuntu2.12 Ubuntu 20.04 LTS libruby2.7 2.7.0-5ubuntu1.18+esm4 Available with Ubuntu Pro ruby2.7 2.7.0-5ubuntu1.18+esm4 Available with Ubuntu Pro Ubuntu 18.04 LTS libruby2.5 2.5.1-1ubuntu1.16+esm7 Available with Ubuntu Pro ruby2.5 2.5.1-1ubuntu1.16+esm7 Available with Ubuntu Pro Ubuntu 16.04 LTS libruby2.3 2.3.1-2~ubuntu16.04.16+esm12 Available with Ubuntu Pro ruby2.3 2.3.1-2~ubuntu16.04.16+esm12 Available with Ubuntu Pro ruby2.3-tcltk 2.3.1-2~ubuntu16.04.16+esm12 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2025-61594

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Ruby Vulnerability Exposes Sensitive Information in Ubuntu A critical security vulnerability has been identified in the Ruby URI gem affecting multiple Ubuntu releases, including 25.10, 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS, and 16.04 LTS. The flaw allows remote attackers to potentially leak sensitive information, including authentication credentials, by improperly handling URIs. The vulnerability is linked to CVE-2025-61594, published on December 30, 2025. Users are advised to update their systems to the latest package versions to mitigate the risk. The affected Ruby versions include 3.3, 3.2, 3.0, 2.7, 2.5, and 2.3. A standard system update will address the issue across the affected Ubuntu versions. The vulnerability poses a significant risk to users who may inadvertently expose sensitive data through applications utilizing the Ruby URI gem. 2 sources 71

Extracted Entities

Ubuntu 25.10 Ruby Critical Sensitive Info Exposure USN-8137

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)