ALAS2-2025-2931

Amazon Linux 2 Security Advisory: ALAS2-2025-2931
Advisory Released Date: 2025-07-30
Advisory Updated Date: 2025-07-30
Severity: Medium
Issue Overview:

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions.

The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876. (CVE-2025-6442)


Affected Packages:

ruby


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update ruby or yum update --advisory ALAS2-2025-2931 to update your system.

New Packages:
aarch64:
    ruby-2.0.0.648-36.amzn2.0.15.aarch64
    ruby-devel-2.0.0.648-36.amzn2.0.15.aarch64
    ruby-libs-2.0.0.648-36.amzn2.0.15.aarch64
    rubygem-bigdecimal-1.2.0-36.amzn2.0.15.aarch64
    rubygem-io-console-0.4.2-36.amzn2.0.15.aarch64
    rubygem-json-1.7.7-36.amzn2.0.15.aarch64
    rubygem-psych-2.0.0-36.amzn2.0.15.aarch64
    ruby-tcltk-2.0.0.648-36.amzn2.0.15.aarch64
    ruby-debuginfo-2.0.0.648-36.amzn2.0.15.aarch64

i686:
    ruby-2.0.0.648-36.amzn2.0.15.i686
    ruby-devel-2.0.0.648-36.amzn2.0.15.i686
    ruby-libs-2.0.0.648-36.amzn2.0.15.i686
    rubygem-bigdecimal-1.2.0-36.amzn2.0.15.i686
    rubygem-io-console-0.4.2-36.amzn2.0.15.i686
    rubygem-json-1.7.7-36.amzn2.0.15.i686
    rubygem-psych-2.0.0-36.amzn2.0.15.i686
    ruby-tcltk-2.0.0.648-36.amzn2.0.15.i686
    ruby-debuginfo-2.0.0.648-36.amzn2.0.15.i686

noarch:
    rubygems-2.0.14.1-36.amzn2.0.15.noarch
    rubygems-devel-2.0.14.1-36.amzn2.0.15.noarch
    rubygem-rake-0.9.6-36.amzn2.0.15.noarch
    ruby-irb-2.0.0.648-36.amzn2.0.15.noarch
    rubygem-rdoc-4.0.0-36.amzn2.0.15.noarch
    ruby-doc-2.0.0.648-36.amzn2.0.15.noarch
    rubygem-minitest-4.3.2-36.amzn2.0.15.noarch

src:
    ruby-2.0.0.648-36.amzn2.0.15.src

x86_64:
    ruby-2.0.0.648-36.amzn2.0.15.x86_64
    ruby-devel-2.0.0.648-36.amzn2.0.15.x86_64
    ruby-libs-2.0.0.648-36.amzn2.0.15.x86_64
    rubygem-bigdecimal-1.2.0-36.amzn2.0.15.x86_64
    rubygem-io-console-0.4.2-36.amzn2.0.15.x86_64
    rubygem-json-1.7.7-36.amzn2.0.15.x86_64
    rubygem-psych-2.0.0-36.amzn2.0.15.x86_64
    ruby-tcltk-2.0.0.648-36.amzn2.0.15.x86_64
    ruby-debuginfo-2.0.0.648-36.amzn2.0.15.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2025-6442

Mitre: CVE-2025-6442