CVE-2025-0306

Publication date 9 January 2025

Last updated 21 January 2025

Ubuntu priority

Cvss 3 Severity Score

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ruby2.3	24.10 oracular	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	16.04 LTS xenial	Not affected
ruby2.5	24.10 oracular	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not affected
ruby2.7	24.10 oracular	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not affected
ruby3.0	24.10 oracular	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not in release
ruby3.2	24.10 oracular	Not in release
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
ruby3.3	24.10 oracular	Not affected
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release

Notes

mdeslaur

This issue is mitigated by having implicit rejection enabled in OpenSSL. In Ubuntu, implicit rejection was backported to earlier openssl releases all the way back to bionic, see: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2054090

Severity score breakdown

Parameter	Value
Base score	7.4 · High
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N