The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4104:06 advisory.

    * rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)
      * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202310-18 (Rack: Multiple Vulnerabilities)

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7036-1 advisory.

    It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a     user or automated system were tricked into sending a specially crafted multipart POST request to an     application using Rack, a remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2022-30122)

    It was discovered that Rack was not properly escaping untrusted data when performing logging operations,     which could cause shell escaped sequences to be written to a terminal. If a user or automated system were     tricked into sending a specially crafted request to an application using Rack, a remote attacker could     possibly use this issue to execute arbitrary code in the machine running the application. (CVE-2022-30123)

    It was discovered that Rack did not properly structure regular expressions in some of its parsing     components, which could result in uncontrolled resource consumption if an application using Rack received     specially crafted input. A remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2022-44570, CVE-2022-44571)

    It was discovered that Rack did not properly structure regular expressions in its multipart parsing     component, which could result in uncontrolled resource consumption if an application using Rack to parse     multipart posts received specially crafted input. A remote attacker could possibly use this issue to cause     a denial of service. (CVE-2022-44572)

    It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly     use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27530)

    It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could     possibly use this issue to cause Rack to consume resources, leading to a denial of service.
    (CVE-2023-27539)

    It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use     this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126)

    It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly     use this issue to cause Rack to create large responses, leading to a denial of service. (CVE-2024-26141)

    It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly     use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7343 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

    * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
291880	MiracleLinux 7 : pcs-0.9.169-3.el7.3 (AXSA:2022-4104:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
184012	GLSA-202310-18 : Rack: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/10/30	2023/10/30	critical
207797	Ubuntu 22.04 LTS : Rack vulnerabilities (USN-7036-1)	Nessus	Ubuntu Local Security Checks	2024/9/26	2025/2/17	critical
166903	RHEL 7 : pcs (RHSA-2022:7343)	Nessus	Red Hat Local Security Checks	2022/11/3	2025/1/24	critical

检测

插件搜索

critical

critical

critical

critical