Affecting graphql-ruby CVE-2025-27407

Support
1

We are currently running Foreman 3.10.1 on Oracle Linux 8 and are investigating Qualys finding QID 382952 (CVE-2025-27407) affecting graphql-ruby.

Our investigation found:

  • Foreman version: 3.10.1
  • Installed package: rubygem-graphql-1.13.21-1.el8
  • The Foreman 3.10 repository currently provides only rubygem-graphql-1.13.21-1.el8; no newer package is available.
  • We reviewed the deployed Foreman codebase and did not find usage of GraphQL::Schema.from_introspection or GraphQL::Schema::Loader.load, which are the functions referenced in the CVE advisory.

Could you please clarify:

  1. Is CVE-2025-27407 considered applicable to Foreman 3.10.x?
  2. Is there a plan to update the packaged graphql-ruby dependency (1.13.24 or later, or a backported fix) for the 3.10.x release stream?
  3. If not, is the recommended remediation to upgrade to a newer supported Foreman release?

Any guidance on the supported remediation path would be greatly appreciated.

2

3.10.1 is old, current supported versions are 3.18 and 3.19 which all have rubygem-graphql 1.13.25. So remediation for this and additional CVE would be updating to a supported version.

In your case this would include also the upgrade to EL9, so have a look at the docs on which version of Foreman you can use leapp to do in-place upgrade as the most simple and recommended way of upgrading.

2 Likes