The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4089-1 advisory.

    It was discovered that Rack incorrectly handled carefully crafted requests. A remote attacker could use     this issue to execute a cross-site scripting (XSS) attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Buffer size in multipart parser allows for denial of     service (CVE-2018-16470).

  - Cross-site scripting (XSS) via `scheme` method on     `Rack::Request` (CVE-2018-16471).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-rack to version 2.0.8 fixes the following issues :

  - CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw     via the scheme method on Rack::Request (bsc#1116600).

  - CVE-2019-16782: Fixed a possible information leak and     session hijack vulnerability (bsc#1159548).

This update was imported from the SUSE:SLE-15:Update update project.

- Cross-site scripting (XSS) via `scheme` method on     `Rack::Request` (CVE-2018-16471).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-rack fixes the following issues :

Security issued fixed :

  - CVE-2018-16471: Fixed a cross-site scripting     vulnerability via 'scheme' method (bsc#1116600).

This update was imported from the SUSE:SLE-12:Update update project.

It was discovered that there was an XSS vulnerability in the ruby-rack web-server library.

A malicious request could impact the HTTP/HTTPS scheme being returned to the underlying application.

For Debian 8 'Jessie', this issue has been fixed in ruby-rack version 1.5.2-3+deb8u2.

We recommend that you upgrade your ruby-rack packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-rack to version 2.0.8 fixes the following issues :

CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600).

CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
127805	Ubuntu 16.04 LTS / 18.04 LTS : Rack vulnerability (USN-4089-1)	Nessus	Ubuntu Local Security Checks	8/12/2019	8/27/2024	medium
120874	Fedora 29 : 1:rubygem-rack (2018-e8ff8b7f8e)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	medium
133669	openSUSE Security Update : rubygem-rack (openSUSE-2020-214)	Nessus	SuSE Local Security Checks	2/13/2020	3/27/2024	medium
119245	Fedora 27 : 1:rubygem-rack (2018-5743ef02a1)	Nessus	Fedora Local Security Checks	11/28/2018	7/18/2024	medium
125919	openSUSE Security Update : rubygem-rack (openSUSE-2019-1553)	Nessus	SuSE Local Security Checks	6/14/2019	5/16/2024	medium
119102	Debian DLA-1585-1 : ruby-rack security update	Nessus	Debian Local Security Checks	11/23/2018	7/19/2024	medium
133597	SUSE SLED15 / SLES15 Security Update : rubygem-rack (SUSE-SU-2020:0359-1)	Nessus	SuSE Local Security Checks	2/10/2020	5/18/2022	medium
120205	Fedora 28 : 1:rubygem-rack (2018-02e965a729)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium