A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

The version of AHV installed on the remote host is prior to 20220304.480. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.102001 advisory.

  - An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When     parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant     remote code execution are possible because there are no restrictions on the classes that can be restored.
    (When loading the documentation cache, object injection and resultant remote code execution are also     possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed     version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed     version is rdoc 6.5.1.1. (CVE-2024-27281)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

  - The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to     it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to     crash an application or overwrite a neighbouring variable. (CVE-2024-2961)

  - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker     to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some     circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code     execution and secure boot protection bypass may be achieved. (CVE-2023-4692)

  - An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically     present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations.
    A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting     a high Confidentiality risk. (CVE-2023-4693)

  - A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
    (CVE-2024-1048)

  - A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit     unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into     the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

  - A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory     for arrays before the non-negative length check is performed by the C API entry points. Passing a negative     length to the g_new0 function results in a crash due to the negative length being treated as a huge     positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by     causing the libvirt daemon to crash. (CVE-2024-2494)

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753)

  - The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

  - A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and     3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and     a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however,     for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is     stringio 3.0.1.2. (CVE-2024-27280)

  - An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex     compiler, it is possible to extract arbitrary heap data relative to the start of the text, including     pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1. (CVE-2024-27282)

  - REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it     parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be     impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability.
    As a workaround, don't parse untrusted XMLs. (CVE-2024-35176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3858 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3858-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     September 02, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby2.7     Version        : 2.7.4-1+deb11u2     CVE ID         : CVE-2021-33621 CVE-2022-28739 CVE-2023-28755 CVE-2023-28756                      CVE-2023-36617 CVE-2024-27280 CVE-2024-27281 CVE-2024-27282     Debian Bug     : 1009957 1024799 1038408 1067802 1069966 1069968

    Several vulnerabilities have been discovered in the interpreter for     the Ruby language, which may result in denial-of-service (DoS),     information leak, and remote code execution.

    CVE-2021-33621

        The cgi gem allows HTTP response splitting. This is relevant to         applications that use untrusted user input either to generate an         HTTP response or to create a CGI::Cookie object.

    CVE-2022-28739

        Buffer over-read occurs in String-to-Float conversion, including         Kernel#Float and String#to_f.

    CVE-2023-28755

        A ReDoS issue was discovered in the URI component. The URI parser         mishandles invalid URLs that have specific characters. It causes         an increase in execution time for parsing strings to URI objects.

    CVE-2023-28756

        A ReDoS issue was discovered in the Time component. The Time         parser mishandles invalid URLs that have specific characters. It         causes an increase in execution time for parsing strings to Time         objects.

    CVE-2023-36617

        Follow-up fix for CVE-2023-28755.

    CVE-2024-27280

        A buffer-overread issue was discovered in StringIO. The ungetbyte         and ungetc methods on a StringIO can read past the end of a         string, and a subsequent call to StringIO.gets may return the         memory value.

    CVE-2024-27281

        When parsing .rdoc_options (used for configuration in RDoc) as a         YAML file, object injection and resultant remote code execution         are possible because there are no restrictions on the classes that         can be restored. (When loading the documentation cache, object         injection and resultant remote code execution are also possible if         there were a crafted cache.)

    CVE-2024-27282

        If attacker-supplied data is provided to the Ruby regex compiler,         it is possible to extract arbitrary heap data relative to the         start of the text, including pointers and sensitive strings.

    For Debian 11 bullseye, these problems have been fixed in version     2.7.4-1+deb11u2.

    We recommend that you upgrade your ruby2.7 packages.

    For the detailed security status of ruby2.7 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby2.7

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ruby package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4499 advisory.

    - Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755.
      (CVE-2023-36617)       Resolves: RHEL-5614
    - Fix Buffer overread vulnerability in StringIO.
      (CVE-2024-27280)       Resolves: RHEL-34125
    - Fix RCE vulnerability with .rdoc_options in RDoc.
      (CVE-2024-27281)       Resolves: RHEL-34117
    - Fix Arbitrary memory address read vulnerability with Regex search.
      (CVE-2024-27282)       Resolves: RHEL-33867

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4499 advisory.

    * rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4499 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-48bdd3abbf advisory.

    Upgrade to Ruby 3.2.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-31cac8b8ec advisory.

    Upgrade to Ruby 3.2.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1576 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1576 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1576 advisory.

    ruby     [3.1.4-143]
    - Upgrade to Ruby 3.1.4.
      Resolves: RHEL-5586
    - Fix HTTP response splitting in CGI.
      Resolves: RHEL-5591
    - Fix ReDos vulnerability in URI.
      Resolves: RHEL-28919       Resolves: RHEL-5612
    - Fix ReDos vulnerability in Time.
      Resolves: RHEL-28920
    - Make RDoc soft dependency in IRB.
      Resolves: RHEL-5613

    [3.1.2-142]
    - Bypass git submodule test failure on Git >= 2.38.1.
    - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
    - Fix for tzdata-2022g.
    - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
      Resolves: RHEL-5590
    - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters       Related: RHEL-5590
    - Disable fiddle tests that use FFI closures.
      Related: RHEL-5590

    rubygem-mysql2     [0.5.4-1]
    - New upstream release 0.5.4 by merging Fedora rawhide branch (commit: e21b5b9)       Resolves: rhbz#2063773

    [0.5.3-1]
    - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)       Resolves: rhbz#1817135

    rubygem-pg     [1.3.5-1]
    - Update to pg 1.3.5       Related: rhbz#2063773

    [1.2.3-1]
    - Update to pg 1.2.3 by merging Fedora master branch (commit: 5db4d26)       Resolves: rhbz#1817135

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1576 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.1). (RHEL-29052)

    Security Fix(es):

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)

    * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    Bug Fix(es):

    * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (RHEL-29048)

    * ruby: Ruby cannot read private key in FIPS mode on RHEL 9 (RHEL-12437)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1431 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1431 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1431 advisory.

    ruby     [3.1.4-142]
    - Upgrade to Ruby 3.1.4.
      Resolves: RHEL-28565
    - Fix HTTP response splitting in CGI.
      Resolves: RHEL-28564
    - Fix ReDos vulnerability in URI.
      Resolves: RHEL-28567       Resolves: RHEL-28576
    - Fix ReDos vulnerability in Time.
      Resolves: RHEL-28566
    - Make RDoc soft dependency in IRB.
      Resolves: RHEL-28569

    rubygem-abrt     [0.4.0-1]
    - Update to abrt 0.4.0.
      Resolves: rhbz#1842476

    rubygem-mysql2     [0.5.3-3]
    - Fix SSL related test failure by backporting Fedora commit <c33b1cf>.
      Related: RHEL-28565

    rubygem-pg     [1.3.2-1]
    - Update to pg 1.3.2 by merging Fedora rawhide branch (commit: 39bbd1b)       Resolves: rhbz#2063772

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1431 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.1). (RHEL-28565)

    Security Fix(es):

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)

    * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    Bug Fix(es):

    * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (RHEL-28569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6219-1 advisory.

    It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly     use this issue to cause a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu 20.04 LTS.
    (CVE-2023-28755)

    It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly     use this issue to cause a denial of service. This issue exists because of an incomplete fix for     CVE-2023-28755. (CVE-2023-36617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208276	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102001)	Nessus	Misc.	high
206420	Debian dla-3858 : libruby2.7 - security update	Nessus	Debian Local Security Checks	high
204266	Photon OS 5.0: Ruby PHSA-2024-5.0-0247	Nessus	PhotonOS Local Security Checks	medium
202572	Oracle Linux 8 : ruby (ELSA-2024-4499)	Nessus	Oracle Linux Local Security Checks	medium
202386	Rocky Linux 8 : ruby (RLSA-2024:4499)	Nessus	Rocky Linux Local Security Checks	medium
202189	RHEL 8 : ruby (RHSA-2024:4499)	Nessus	Red Hat Local Security Checks	medium
194967	Fedora 38 : ruby (2024-48bdd3abbf)	Nessus	Fedora Local Security Checks	medium
194960	Fedora 39 : ruby (2024-31cac8b8ec)	Nessus	Fedora Local Security Checks	medium
192949	Rocky Linux 9 : ruby:3.1 (RLSA-2024:1576)	Nessus	Rocky Linux Local Security Checks	high
192894	AlmaLinux 9 : ruby:3.1 (ALSA-2024:1576)	Nessus	Alma Linux Local Security Checks	high
192872	Oracle Linux 9 : ruby:3.1 (ELSA-2024-1576)	Nessus	Oracle Linux Local Security Checks	high
192733	RHEL 9 : ruby:3.1 (RHSA-2024:1576)	Nessus	Red Hat Local Security Checks	high
192616	Rocky Linux 8 : ruby:3.1 (RLSA-2024:1431)	Nessus	Rocky Linux Local Security Checks	high
192401	AlmaLinux 8 : ruby:3.1 (ALSA-2024:1431)	Nessus	Alma Linux Local Security Checks	high
192389	Oracle Linux 8 : ruby:3.1 (ELSA-2024-1431)	Nessus	Oracle Linux Local Security Checks	high
192287	RHEL 8 : ruby:3.1 (RHSA-2024:1431)	Nessus	Red Hat Local Security Checks	high
188287	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2023-2868)	Nessus	Huawei Local Security Checks	medium
188193	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2023-2800)	Nessus	Huawei Local Security Checks	medium
188191	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2023-2824)	Nessus	Huawei Local Security Checks	medium
188175	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2023-2851)	Nessus	Huawei Local Security Checks	medium
178208	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : Ruby vulnerabilities (USN-6219-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2023-36617

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium