Download Ruby 2.5.3 / 2.4.5 / 2.3.8

Ruby is a programming language for fast and easy object-oriented programming. It was created on February 24, 1993 by Yukihiro ‘Matz’ Matsumoto and released in 1995. Ruby is derived from the English word for ruby, a play on Perl. The author says he created Ruby to follow “the principle of least surprise,” meaning that language should be free from the stings and footholds that plague other languages. A few days ago, new versions were released to improve security. The version numbers are pinned to 2.5.3, 2.4.5 and 2.3.8, and bear the following announcements:

Ruby 2.5.3 Released

There were some missing files in the release packages of 2.5.2 which are necessary for building. See details in [Bug #15232]†

This release is just for fixing the packaging issue. This release doesn’t contain any additional bug fixes from 2.5.2.

Ruby 2.5.2 Released

This release includes some bug fixes and some security fixes.

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly

There are also some bug fixes. see commit logs for more details.

Ruby 2.4.5 Released

This release includes about 40 bug fixes after the previous release, and also includes several security fixes. Please check the topics below for details.

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly

see the commit logs for details.

Ruby 2.3.8 Released

This release includes several security fixes. Please check the topics below for details.

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly

This release also includes a non-security fix to support Visual Studio 2014 with Windows 10 October 2018 Update for maintenance reasons.

Ruby 2.3 is now under the state of the security maintenance phase, until the end of the March of 2019. After the date, maintenance of Ruby 2.3 will be ended. We recommend you start planning migration to newer versions of Ruby, such as 2.5 or 2.4.