CVE-2025-0306: Ruby: openssl: ruby marvin attack
A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
Other sources
Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging large number of messages with the vulnerable service.
The attacker needs to be able to directly or indirectly measure the time of calling to RSA::privatedecrypt() or PKey::decrypt() and the error handling of those methods. Attacks over network are possible if network service can be made to perform calls to those functions with attacker controlled messages.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0306?
CVE-2025-0306 is a high-severity vulnerability due to its ability to allow attackers to decrypt messages or forge signatures.
How does CVE-2025-0306 exploit the Ruby interpreter?
CVE-2025-0306 exploits the Ruby interpreter by enabling attackers to perform the Marvin Attack, exchanging numerous messages to compromise security.
Which versions of Ruby are affected by CVE-2025-0306?
CVE-2025-0306 affects all versions of Ruby that utilize the vulnerable interpreter without addressing the vulnerability.
What are the potential impacts of CVE-2025-0306?
The potential impacts of CVE-2025-0306 include unauthorized access to encrypted information and the ability to forge digital signatures.
How can I mitigate the risks of CVE-2025-0306?
Mitigation for CVE-2025-0306 includes updating Ruby to the latest patched version that addresses this vulnerability.