Synopsis
The remote Debian host is missing one or more security-related updates.
Description
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3149 advisory.
- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3149-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler October 12, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ruby-nokogiri Version : 1.10.0+dfsg1-2+deb10u1 CVE ID : CVE-2019-5477 CVE-2020-26247 CVE-2022-24836 Debian Bug : 934802 978967 1009787
Multiple vulnerabilities were discovered in Nokogiri, an HTML/XML/SAX/Reader parser for the Ruby programming language, leading to command injection, XML external entity injection (XXE), and denial-of-service (DoS).
CVE-2019-5477
A command injection vulnerability allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries.
CVE-2020-26247
XXE vulnerability: XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible.
CVE-2022-24836
Nokogiri contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.
For Debian 10 buster, these problems have been fixed in version 1.10.0+dfsg1-2+deb10u1.
We recommend that you upgrade your ruby-nokogiri packages.
For the detailed security status of ruby-nokogiri please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-nokogiri
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the ruby-nokogiri packages.
Plugin Details
File Name: debian_DLA-3149.nasl
Agent: unix
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:ruby-nokogiri
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 10/12/2022
Vulnerability Publication Date: 8/16/2019