Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging large number of messages with the vulnerable service.

The attacker needs to be able to directly or indirectly measure the time of calling to RSA::private_decrypt() or PKey::decrypt() and the error handling of those methods. Attacks over network are possible if network service can be made to perform calls to those functions with attacker controlled messages.