<?xml version="1.0" encoding="utf-8"?>
  <?xml-stylesheet type="text/xsl" href="sa-render.xsl"?>
  <update from="huaweicloud.com" type="security" status="stable" version="1">
    <id>HCE2-SA-2026-0036</id>
    <title>An update for ruby is now available for HCE 2.0</title>
    <severity>Moderate</severity>
    <release>HCE 2.0</release>
    <issued date="2026-03-02 12:00:44"/>
    <updated date="2026-03-02 12:00:44"/>
    <references>
      <reference href="https://nvd.nist.gov/vuln/detail/CVE-2025-61594" id="CVE-2025-61594" title="CVE-2025-61594 Base Score: 4.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N" type="cve"/>
    </references>
    <description>Security Fix(es):

当使用 + 操作符拼接 URI 时，原始 URI 中的密码等敏感信息可能会被泄漏，这违反了 RFC3986 规范，并可能导致应用受到敏感信息泄漏的威胁。 (CVE-2025-61594)
</description>
    <pkglist>
      <collection short="HCE 2.0" package="ruby">
        <name>HCE 2.0</name>
        <package arch="noarch" name="rubygems" version="3.2.32" release="122.r18.hce2">
          <filename>rubygems-3.2.32-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygems-devel" version="3.2.32" release="122.r18.hce2">
          <filename>rubygems-devel-3.2.32-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-bigdecimal" version="3.0.0" release="122.r18.hce2">
          <filename>rubygem-bigdecimal-3.0.0-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-did_you_mean" version="1.5.0" release="122.r18.hce2">
          <filename>rubygem-did_you_mean-1.5.0-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-io-console" version="0.5.7" release="122.r18.hce2">
          <filename>rubygem-io-console-0.5.7-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-json" version="2.5.1" release="122.r18.hce2">
          <filename>rubygem-json-2.5.1-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-minitest" version="5.14.2" release="122.r18.hce2">
          <filename>rubygem-minitest-5.14.2-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-openssl" version="2.2.1" release="122.r18.hce2">
          <filename>rubygem-openssl-2.2.1-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-power_assert" version="1.2.0" release="122.r18.hce2">
          <filename>rubygem-power_assert-1.2.0-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-psych" version="3.3.2" release="122.r18.hce2">
          <filename>rubygem-psych-3.3.2-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rake" version="13.0.3" release="122.r18.hce2">
          <filename>rubygem-rake-13.0.3-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rbs" version="1.4.0" release="122.r18.hce2">
          <filename>rubygem-rbs-1.4.0-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rdoc" version="6.3.3" release="122.r18.hce2">
          <filename>rubygem-rdoc-6.3.3-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rexml" version="3.2.5" release="122.r18.hce2">
          <filename>rubygem-rexml-3.2.5-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rss" version="0.2.9" release="122.r18.hce2">
          <filename>rubygem-rss-0.2.9-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-test-unit" version="3.3.7" release="122.r18.hce2">
          <filename>rubygem-test-unit-3.3.7-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-typeprof" version="0.15.2" release="122.r18.hce2">
          <filename>rubygem-typeprof-0.15.2-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="x86_64" name="ruby" version="3.0.3" release="122.r18.hce2">
          <filename>ruby-3.0.3-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="ruby-devel" version="3.0.3" release="122.r18.hce2">
          <filename>ruby-devel-3.0.3-122.r18.hce2.x86_64.rpm</filename>
        </package>
        <package arch="noarch" name="ruby-help" version="3.0.3" release="122.r18.hce2">
          <filename>ruby-help-3.0.3-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="ruby-irb" version="3.0.3" release="122.r18.hce2">
          <filename>ruby-irb-3.0.3-122.r18.hce2.noarch.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-bigdecimal" version="3.0.0" release="122.r18.hce2">
          <filename>rubygem-bigdecimal-3.0.0-122.r18.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-io-console" version="0.5.7" release="122.r18.hce2">
          <filename>rubygem-io-console-0.5.7-122.r18.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-json" version="2.5.1" release="122.r18.hce2">
          <filename>rubygem-json-2.5.1-122.r18.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-openssl" version="2.2.1" release="122.r18.hce2">
          <filename>rubygem-openssl-2.2.1-122.r18.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-psych" version="3.3.2" release="122.r18.hce2">
          <filename>rubygem-psych-3.3.2-122.r18.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="ruby" version="3.0.3" release="122.r18.hce2">
          <filename>ruby-3.0.3-122.r18.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="ruby-devel" version="3.0.3" release="122.r18.hce2">
          <filename>ruby-devel-3.0.3-122.r18.hce2.aarch64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
