リモートのRedhat Enterprise Linux 7ホストにインストールされているパッケージは、RHSA-2021：2104アドバイザリに記載されている複数の脆弱性の影響を受けます。

  - ruby：File.fnmatchとFile.fnmatch?のNULLインジェクションの脆弱性 (CVE-2019-15845)

  - ruby：WEBrickのDigest認証の正規表現のサービス拒否の脆弱性 (CVE-2019-16201)

  - ruby：WEBrickでのHTTP応答分割 (CVE-2019-16254)

  - ruby：Shell#test / Shell#[]のコマンド引数によるコードインジェクション (CVE-2019-16255)

  - rubygem-json：JSONでの安全ではないオブジェクト作成の脆弱性 (CVE-2020-10663)

  - ruby：BasicSocket＃read_nonblockメソッドが情報漏洩を引き起こす (CVE-2020-10933)

  - ruby：WEBrickにおけるHTTPリクエストスマグリングの可能性（CVE-2020-25613）

  - ruby：REXMLでのXMLラウンドトリップの脆弱性 (CVE-2021-28965)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

このruby2.5のバージョン2.5.8への更新では、次の問題を修正します：

CVE-2020-10663：JSONでの安全ではないオブジェクト作成の脆弱性（bsc#1167244）。

CVE-2020-10933：ソケットライブラリ内のヒープ漏洩の脆弱性（bsc#1168938）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

The version of ruby installed on the remote host is prior to 2.6.6-125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-007 advisory.

  - jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function     does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery     determined whether the input was HTML by looking for the '<' character anywhere in the string, giving     attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery     only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability     only to attackers who can control the beginning of a string, which is far less common. (CVE-2012-6708)

  - jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request     is performed without the dataType option, causing text/javascript responses to be executed.
    (CVE-2015-9251)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0581 advisory.

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

  - rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

  - ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

  - ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

  - ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

  - ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ruby package has been released.

Update to Ruby 2.6.6. Also fixes CVE-2020-10933 and CVE-2020-10663.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby     2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability.
    This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby.
    Specifically, use of JSON parsing methods can lead to     creation of a malicious object within the interpreter,     with adverse effects that are     application-dependent.(CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7,     2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer,     exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the     buffer string provides the previous value of the heap.
    This may expose possibly sensitive data from the     interpreter.(CVE-2020-10933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2588 advisory.

  - rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2587 advisory.

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2588 advisory.

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage     location for gems, if locations under the user's home directory are not available. If Bundler is used in a     scenario where the user does not have a writable home directory, an attacker could place malicious code in     this directory that would be later loaded and executed. (CVE-2019-3881)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not     properly address XML round-trip issues. An incorrect document can be produced after parsing and     serializing. (CVE-2021-28965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2104 advisory.

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ruby2.5 to version 2.5.8 fixes the following issues :

CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (bsc#1167244).

CVE-2020-10933: Heap exposure vulnerability in the socket library (bsc#1168938).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0582 advisory.

  - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

  - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

  - ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

  - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

  - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

  - rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

  - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

  - rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

  - ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

  - ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

  - ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

  - ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2587 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

    Security Fix(es):

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2587 advisory.

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls     BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit     the requested size, but no data is copied. Thus, the buffer string provides the previous value of the     heap. This may expose possibly sensitive data from the interpreter. (CVE-2020-10933)

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not     properly address XML round-trip issues. An incorrect document can be produced after parsing and     serializing. (CVE-2021-28965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165116	RHEL 7: rh-ruby25-ruby (RHSA-2021: 2104)	Nessus	Red Hat Local Security Checks	2022/9/15	2024/4/28	high
135671	SUSE SLED15 / SLES15セキュリティ更新プログラム：ruby2.5（SUSE-SU-2020:0995-1）	Nessus	SuSE Local Security Checks	2020/4/16	2024/3/15	high
182068	Amazon Linux 2 : ruby (ALASRUBY2.6-2023-007)	Nessus	Amazon Linux Local Security Checks	2023/9/27	2023/9/28	high
158216	RHEL 8 : ruby:2.6 (RHSA-2022:0581)	Nessus	Red Hat Local Security Checks	2022/2/22	2024/4/28	high
136693	Photon OS 1.0: Ruby PHSA-2020-1.0-0294	Nessus	PhotonOS Local Security Checks	2020/5/18	2024/3/12	high
136781	Fedora 31 : ruby (2020-a95706b117)	Nessus	Fedora Local Security Checks	2020/5/22	2024/3/12	high
136868	EulerOS 2.0 SP8 : ruby (EulerOS-SA-2020-1590)	Nessus	Huawei Local Security Checks	2020/5/26	2024/3/8	high
151143	RHEL 8 : ruby:2.6 (RHSA-2021:2588)	Nessus	Red Hat Local Security Checks	2021/6/29	2024/4/28	high
151147	CentOS 8 : ruby:2.5 (CESA-2021:2587)	Nessus	CentOS Local Security Checks	2021/6/29	2023/12/12	high
179413	AlmaLinux 8 : ruby:2.6 (ALSA-2021:2588)	Nessus	Alma Linux Local Security Checks	2023/8/7	2023/8/7	high
165116	RHEL 7 : rh-ruby25-ruby (RHSA-2021:2104)	Nessus	Red Hat Local Security Checks	2022/9/15	2024/4/28	high
136572	Photon OS 2.0: Ruby PHSA-2020-2.0-0242	Nessus	PhotonOS Local Security Checks	2020/5/13	2024/3/12	medium
135671	SUSE SLED15 / SLES15 Security Update : ruby2.5 (SUSE-SU-2020:0995-1)	Nessus	SuSE Local Security Checks	2020/4/16	2024/3/15	high
158215	RHEL 8 : ruby:2.6 (RHSA-2022:0582)	Nessus	Red Hat Local Security Checks	2022/2/22	2024/4/28	high
151141	RHEL 8 : ruby:2.5 (RHSA-2021:2587)	Nessus	Red Hat Local Security Checks	2021/6/29	2024/6/3	high
151284	Oracle Linux 8 : ruby:2.5 (ELSA-2021-2587)	Nessus	Oracle Linux Local Security Checks	2021/7/2	2023/12/11	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high