The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1641 advisory.

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute     arbitrary code via | and tags in a filename. (CVE-2021-31799)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : ruby (ALAS-2021-1641)

high Nessus Plugin ID 149871

Version 1.5

Version 1.4

Version 1.5 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930
Version 1.4 Feb 21, 2023, 4:03 AM Regenerated based on advisory update Plugin Feed: 202302210403