An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.

The version of ruby installed on the remote host is prior to 2.6.6-125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-007 advisory.

  - jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function     does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery     determined whether the input was HTML by looking for the '<' character anywhere in the string, giving     attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery     only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability     only to attackers who can control the beginning of a string, which is far less common. (CVE-2012-6708)

  - jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request     is performed without the dataType option, causing text/javascript responses to be executed.
    (CVE-2015-9251)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2588 advisory.

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage     location for gems, if locations under the user's home directory are not available. If Bundler is used in a     scenario where the user does not have a writable home directory, an attacker could place malicious code in     this directory that would be later loaded and executed. (CVE-2019-3881)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not     properly address XML round-trip issues. An incorrect document can be produced after parsing and     serializing. (CVE-2021-28965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2230 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby26-ruby (2.6.7).
    (BZ#1701182)

    Security Fix(es):

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh-ruby26-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains     leading zero [rhscl-3] (BZ#1950331)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.7 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2104 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby25-ruby (2.5.9).
    (BZ#1952998)

    Security Fix(es):

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh-ruby25-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains     leading zero [rhscl-3] (BZ#1953001)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0581 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0582 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:2587 advisory.

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not     properly address XML round-trip issues. An incorrect document can be produced after parsing and     serializing. (CVE-2021-28965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:2588 advisory.

  - Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage     location for gems, if locations under the user's home directory are not available. If Bundler is used in a     scenario where the user does not have a writable home directory, an attacker could place malicious code in     this directory that would be later loaded and executed. (CVE-2019-3881)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not     properly address XML round-trip issues. An incorrect document can be produced after parsing and     serializing. (CVE-2021-28965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2588 advisory.

    ruby     [2.6.7-107]
    - Upgrade to Ruby 2.6.7.
      Resolves: rhbz#1952627
    - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address       containing leading zero       Resolves: rhbz#1954968
    - Fix: Rubygem-bundler: Don't use insecure tmp directory as home       allows for execution of malicious code.
      Resolves: rhbz#1954969

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2587 advisory.

    ruby     [2.5.9-107]
    - Update to Ruby 2.5.9.
      * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed       Resolves: rhbz#1952626
    - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address       contains leading zero       Resolves: rhbz#1955010

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2587 advisory.

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2588 advisory.

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2588 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

    Security Fix(es):

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains     leading zero [rhel-8] (BZ#1954968)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2587 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

    Security Fix(es):

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4882-1 advisory.

    It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated     system were tricked into parsing a specially crafted JSON file, a remote attacker could use this issue to     execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10663)

    It was discovered that Ruby incorrectly handled certain socket memory operations. A remote attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-10933)

    It was discovered that Ruby incorrectly handled certain transfer-encoding headers when using Webrick. A     remote attacker could possibly use this issue to bypass a reverse proxy. (CVE-2020-25613)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the interpreter for the Ruby language.

  - CVE-2020-10663     Jeremy Evans reported an unsafe object creation     vulnerability in the json gem bundled with Ruby. When     parsing certain JSON documents, the json gem can be     coerced into creating arbitrary objects in the target     system.

  - CVE-2020-10933     Samuel Williams reported a flaw in the socket library     which may lead to exposure of possibly sensitive data     from the interpreter.

According to the versions of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Ruby 2.5.x through 2.5.7,     2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer,     exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the     buffer string provides the previous value of the heap.
    This may expose possibly sensitive data from the     interpreter.(CVE-2020-10933)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby     2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability.
    This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby.
    Specifically, use of JSON parsing methods can lead to     creation of a malicious object within the interpreter,     with adverse effects that are     application-dependent.(CVE-2020-10663)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby     2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability.
    This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby.
    Specifically, use of JSON parsing methods can lead to     creation of a malicious object within the interpreter,     with adverse effects that are     application-dependent.(CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7,     2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer,     exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the     buffer string provides the previous value of the heap.
    This may expose possibly sensitive data from the     interpreter.(CVE-2020-10933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Ruby 2.6.6. Also fixes CVE-2020-10933 and CVE-2020-10663.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the ruby package has been released.

This update for ruby2.5 to version 2.5.8 fixes the following issues :

  - CVE-2020-10663: Unsafe Object Creation Vulnerability in     JSON (bsc#1167244).

  - CVE-2020-10933: Heap exposure vulnerability in the     socket library (bsc#1168938).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ruby2.5 to version 2.5.8 fixes the following issues :

CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (bsc#1167244).

CVE-2020-10933: Heap exposure vulnerability in the socket library (bsc#1168938).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
182068	Amazon Linux 2 : ruby (ALASRUBY2.6-2023-007)	Nessus	Amazon Linux Local Security Checks	high
179413	AlmaLinux 8 : ruby:2.6 (ALSA-2021:2588)	Nessus	Alma Linux Local Security Checks	high
165130	RHEL 7 : rh-ruby26-ruby (RHSA-2021:2230)	Nessus	Red Hat Local Security Checks	high
165116	RHEL 7 : rh-ruby25-ruby (RHSA-2021:2104)	Nessus	Red Hat Local Security Checks	high
158216	RHEL 8 : ruby:2.6 (RHSA-2022:0581)	Nessus	Red Hat Local Security Checks	high
158215	RHEL 8 : ruby:2.6 (RHSA-2022:0582)	Nessus	Red Hat Local Security Checks	high
157806	Rocky Linux 8 : ruby:2.5 (RLSA-2021:2587)	Nessus	Rocky Linux Local Security Checks	high
157798	Rocky Linux 8 : ruby:2.6 (RLSA-2021:2588)	Nessus	Rocky Linux Local Security Checks	high
151449	Oracle Linux 8 : ruby:2.6 (ELSA-2021-2588)	Nessus	Oracle Linux Local Security Checks	high
151284	Oracle Linux 8 : ruby:2.5 (ELSA-2021-2587)	Nessus	Oracle Linux Local Security Checks	high
151147	CentOS 8 : ruby:2.5 (CESA-2021:2587)	Nessus	CentOS Local Security Checks	high
151146	CentOS 8 : ruby:2.6 (CESA-2021:2588)	Nessus	CentOS Local Security Checks	high
151143	RHEL 8 : ruby:2.6 (RHSA-2021:2588)	Nessus	Red Hat Local Security Checks	high
151141	RHEL 8 : ruby:2.5 (RHSA-2021:2587)	Nessus	Red Hat Local Security Checks	high
147970	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Ruby vulnerabilities (USN-4882-1)	Nessus	Ubuntu Local Security Checks	high
138227	Debian DSA-4721-1 : ruby2.5 - security update	Nessus	Debian Local Security Checks	high
137798	EulerOS Virtualization for ARM 64 3.0.6.0 : ruby (EulerOS-SA-2020-1691)	Nessus	Huawei Local Security Checks	high
136868	EulerOS 2.0 SP8 : ruby (EulerOS-SA-2020-1590)	Nessus	Huawei Local Security Checks	high
136781	Fedora 31 : ruby (2020-a95706b117)	Nessus	Fedora Local Security Checks	high
136693	Photon OS 1.0: Ruby PHSA-2020-1.0-0294	Nessus	PhotonOS Local Security Checks	high
136581	Photon OS 3.0: Ruby PHSA-2020-3.0-0089	Nessus	PhotonOS Local Security Checks	high
136572	Photon OS 2.0: Ruby PHSA-2020-2.0-0242	Nessus	PhotonOS Local Security Checks	medium
136309	openSUSE Security Update : ruby2.5 (openSUSE-2020-586)	Nessus	SuSE Local Security Checks	high
135671	SUSE SLED15 / SLES15 Security Update : ruby2.5 (SUSE-SU-2020:0995-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-10933

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high