The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3668 advisory.

    ruby     [3.1.5-144]
    - Upgrade to Ruby 3.1.5.
      Resolves: RHEL-33978
    - Fix buffer overread vulnerability in StringIO.
      Resolves: RHEL-34129
    - Fix RCE vulnerability with .rdoc_options in RDoc.
      Resolves: RHEL-34121
    - Fix arbitrary memory address read vulnerability with Regex search.
      Resolves: RHEL-33871

    [3.1.4-143]
    - Upgrade to Ruby 3.1.4.
      Resolves: RHEL-5586
    - Fix HTTP response splitting in CGI.
      Resolves: RHEL-5591
    - Fix ReDos vulnerability in URI.
      Resolves: RHEL-28919       Resolves: RHEL-5612
    - Fix ReDos vulnerability in Time.
      Resolves: RHEL-28920
    - Make RDoc soft dependency in IRB.
      Resolves: RHEL-5613

    [3.1.2-142]
    - Bypass git submodule test failure on Git >= 2.38.1.
    - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
    - Fix for tzdata-2022g.
    - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
      Resolves: RHEL-5590
    - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters       Related: RHEL-5590
    - Disable fiddle tests that use FFI closures.
      Related: RHEL-5590

    [3.1.2-141]
    - Upgrade to Ruby 3.1.2 by merging Fedora Rawhide branch (commit: b7b5473).
      Resolves: rhbz#2063773

    rubygem-mysql2     [0.5.4-1]
    - New upstream release 0.5.4 by merging Fedora rawhide branch (commit: e21b5b9)       Resolves: rhbz#2063773

    [0.5.3-1]
    - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)       Resolves: rhbz#1817135

    rubygem-pg
    * Thu May 26 2022 Jarek Prokop - 1.3.5-1
    - Update to pg 1.3.5       Related: rhbz#2063773

    [1.2.3-1]
    - Update to pg 1.2.3 by merging Fedora master branch (commit: 5db4d26)       Resolves: rhbz#1817135

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 9 : ruby:3.1 (ELSA-2024-3668)

critical Nessus Plugin ID 200183

Version 1.2

Version 1.1

Version 1.2 Jul 3, 2024, 6:50 AM CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2024-27280") CVSSv3 severity (based on CVE-2024-27280, severity increased from "Medium" to "High") Plugin Feed: 202407030650
Version 1.1 Jun 7, 2024, 2:43 PM New Plugin Feed: 202406071443