CVE-2025-0306
Published: 09 January 2025
Description
A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
Security Summary
CVE-2025-0306 is a vulnerability in the Ruby interpreter that exposes it to the Marvin Attack. Published on 2025-01-09, this issue is classified under CWE-385 and carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with no availability effects.
The attack requires a remote, unauthenticated adversary to engage the vulnerable service over the network, though it demands high complexity with no user interaction needed. By exchanging a large number of messages with the service, the attacker can decrypt previously encrypted messages or forge signatures.
Mitigation guidance is provided in vendor advisories, including Red Hat security updates at https://access.redhat.com/security/cve/CVE-2025-0306 and https://bugzilla.redhat.com/show_bug.cgi?id=2336100, as well as NetApp advisory ntap-20250221-0009/ at https://security.netapp.com/advisory/ntap-20250221-0009/.
Details
- CWE(s)