A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ruby-3.0.4-160.el9 build changelog.

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

  - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. (CVE-2022-28739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-27 (Ruby: Multiple vulnerabilities)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP     server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
    This potentially makes curl extract information about services that are otherwise private and not     disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a StartTLS stripping attack. (CVE-2021-32066)

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer     overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of     bytes. This also affects the CGI gem before 0.3.1 for Ruby. (CVE-2021-41816)

  - Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via     a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. (CVE-2021-41817)

  - CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects     the CGI gem through 0.3.0 for Ruby. (CVE-2021-41819)

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

  - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. (CVE-2022-28739)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6585 advisory.

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

  - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. (CVE-2022-28739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ruby installed on the remote host is prior to 3.0.4-155. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY3.0-2023-002 advisory.

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

  - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. (CVE-2022-28739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6450 advisory.

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6585 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6855 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.4).
    (BZ#2128628)

    Security Fix(es):

    * ruby: buffer overflow in CGI.escape_html (CVE-2021-41816)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    * Ruby: Double free in Regexp compilation (CVE-2022-28738)

    * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh-ruby30 ruby: User-installed rubygems plugins are not being loaded (BZ#2128629)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6585 advisory.

    - Fix double free in Regexp compilation.
      Resolves: CVE-2022-28738

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6585 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109428)

    Security Fix(es):

    * Ruby: Double free in Regexp compilation (CVE-2022-28738)

    * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6450 advisory.

    - Fix double free in Regexp compilation.
      Resolves: CVE-2022-28738

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6450 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109431)

    Security Fix(es):

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    * Ruby: Double free in Regexp compilation (CVE-2022-28738)

    * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ruby 3.0: User-installed rubygems plugins are not being loaded [RHEL8] (BZ#2110981)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:6450 advisory.

  - ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

  - ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

  - Ruby: Double free in Regexp compilation (CVE-2022-28738)

  - Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5462-1 advisory.

    It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly     use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-28738)

    It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue     to expose sensitive information. (CVE-2022-28739)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ruby installed on the remote host is prior to 3.0.4 / 3.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-103-01 advisory.

  - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. (CVE-2022-28739)

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f22144d7-bad1-11ec-9cfe-0800270512f4 advisory.

  - piao reports:              Due to a bug in the Regexp compilation process, creating             a Regexp     object with a crafted source string could cause             the same memory to be freed twice. This is     known as a             double free vulnerability. Note that, in general, it             is considered     unsafe to create and use a Regexp object             generated from untrusted input. In this case,     however,             following a comprehensive assessment, we treat this issue             as a     vulnerability.            (CVE-2022-28738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191346	CentOS 9 : ruby-3.0.4-160.el9	Nessus	CentOS Local Security Checks	critical
189405	GLSA-202401-27 : Ruby: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
184675	Rocky Linux 9 : ruby (RLSA-2022:6585)	Nessus	Rocky Linux Local Security Checks	critical
181966	Amazon Linux 2 : ruby (ALASRUBY3.0-2023-002)	Nessus	Amazon Linux Local Security Checks	critical
167825	Rocky Linux 8 : ruby:3.0 (RLSA-2022:6450)	Nessus	Rocky Linux Local Security Checks	critical
167693	AlmaLinux 9 : ruby (ALSA-2022:6585)	Nessus	Alma Linux Local Security Checks	critical
166007	RHEL 7 : rh-ruby30-ruby (RHSA-2022:6855)	Nessus	Red Hat Local Security Checks	critical
165272	Oracle Linux 9 : ruby (ELSA-2022-6585)	Nessus	Oracle Linux Local Security Checks	critical
165267	RHEL 9 : ruby (RHSA-2022:6585)	Nessus	Red Hat Local Security Checks	critical
165172	Oracle Linux 8 : ruby:3.0 (ELSA-2022-6450)	Nessus	Oracle Linux Local Security Checks	critical
164972	RHEL 8 : ruby:3.0 (RHSA-2022:6450)	Nessus	Red Hat Local Security Checks	critical
164956	CentOS 8 : ruby:3.0 (CESA-2022:6450)	Nessus	CentOS Local Security Checks	critical
161909	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Ruby vulnerabilities (USN-5462-1)	Nessus	Ubuntu Local Security Checks	critical
159726	Slackware Linux 15.0 / current ruby Multiple Vulnerabilities (SSA:2022-103-01)	Nessus	Slackware Local Security Checks	critical
159692	FreeBSD : Ruby -- Double free in Regexp compilation (f22144d7-bad1-11ec-9cfe-0800270512f4)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2022-28738

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical