{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://git.ruby-lang.org/ruby.git","packageName":"Ruby","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:2.5/ruby","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.1/ruby","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.3/ruby","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.1/ruby","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby:3.3/ruby","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ruby","product":"Red Hat Storage 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2025-0306","cwes":["CWE-385"],"description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","epss":{"date":"2026-11-05","percentile":0.51652,"score":0.00658},"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793889954824,"publishedAt":1736395542194,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-0306"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2336100"},{"source":"ADP: CVE","tags":[],"url":"https://security.netapp.com/advisory/ntap-20250221-0009/"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"See the following possible mitigations for this flaw:\n\n* Do not use the methods with PKCS#1v1.5 padding in network contexts. Make sure that any calls that happen, will perform OAEP decryption only. Do not support PKCS#1v1.5 encryption padding at all.\n\n* Use Ruby with a version of OpenSSL that has the implicit rejection mechanism implemented.(https://github.com/openssl/openssl/pull/13817, https://github.com/openssl/openssl/commit/7fc67e0a33102aa47bbaa56533eeecb98c0450f7 included in 3.2.0, backported to RHEL-8)"}],"revision":"5d2ffb1531e01c9620a9170f766d6152b7fc2724060831c1eebf8df1a8dded82","sources":[{"modifiedAt":1793889954824,"name":"CNA: redhat","retrievedAt":1793891333236,"url":"https://www.cve.org/CVERecord?id=CVE-2025-0306"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793891365526,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-0306"}],"ssvc":{"assessedAt":1736439758700,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Ruby: openssl: ruby marvin attack","updatedAt":1793891365526}