The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2113 advisory.

    - Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack       Resolves: RHEL-26446, RHEL-26448, RHEL-26450

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2953 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3431 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016518 advisory.

    Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6837-1 advisory.

    It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly     use this issue to cause Rack to consume resources, leading to a denial of service. This issue only     affected Ubuntu 23.10. (CVE-2023-27530)

    It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use     this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126)

    It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly     use this issue to cause Rack to create large responses, leading to a denial of service. This issue only     affected Ubuntu 24.04 LTS. (CVE-2024-26141)

    It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly     use this issue to cause Rack to consume resources, leading to a denial of service. This issue only     affected Ubuntu 24.04 LTS. (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6689-1 advisory.

    It was discovered that Rack incorrectly parse some headers. An attacker could possibly use this issue to     cause a denial of service. (CVE-2023-27539, CVE-2024-26141, CVE-2024-26146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-203b7db566 advisory.

    https://fedoraproject.org/wiki/Changes/Ruby_on_Rails_8.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0946-1 advisory.

    - CVE-2024-25126: Fixed a Denial of Service Vulnerability in Rack Content-Type Parsing (bsc#1220239)
    - CVE-2024-26141: Fixed a Denial of Service Vulnerability in Range request header parsing (bsc#1220242)
    - CVE-2024-26146: Fixed a Denial of Service vulnerability in Rack headers parsing routine (bsc#1220248)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2953 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3800 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3800-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     April 29, 2024                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby-rack     Version        : 2.0.6-3+deb10u4     CVE ID         : CVE-2024-25126 CVE-2024-26141 CVE-2024-26146     Debian Bug     : 1064516

    Multiple vulnerabilities were fixed in ruby-rack,     an interface for developing web applications in Ruby.

    CVE-2024-25126

        ReDoS in Content Type header parsing

    CVE-2024-26141

        Reject Range headers which are too large

    CVE-2024-26146

        ReDoS in Accept header parsing

    For Debian 10 buster, these problems have been fixed in version     2.0.6-3+deb10u4.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
195026	Oracle Linux 9 : pcs (ELSA-2024-2113)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	high
197763	RHEL 8 : pcs (RHSA-2024:2953)	Nessus	Red Hat Local Security Checks	2024/5/23	2025/2/17	high
197979	RHEL 8 : pcs (RHSA-2024:3431)	Nessus	Red Hat Local Security Checks	2024/5/28	2025/2/17	high
313084	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rubygem-rack (UTSA-2026-016518)	Nessus	Unity Linux Local Security Checks	2026/5/7	2026/5/7	high
200667	Ubuntu 23.10 / 24.04 LTS : Rack vulnerabilities (USN-6837-1)	Nessus	Ubuntu Local Security Checks	2024/6/17	2025/9/3	high
191925	Ubuntu 23.10 : Rack vulnerabilities (USN-6689-1)	Nessus	Ubuntu Local Security Checks	2024/3/12	2025/2/17	high
242193	Fedora 43 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-203b7db566)	Nessus	Fedora Local Security Checks	2025/7/16	2025/7/16	medium
192492	SUSE SLES12 Security Update : rubygem-rack-1_4 (SUSE-SU-2024:0946-1)	Nessus	SuSE Local Security Checks	2024/3/23	2026/6/26	high
197690	CentOS 8 : pcs (CESA-2024:2953)	Nessus	CentOS Local Security Checks	2024/5/22	2025/2/17	high
194449	Debian dla-3800 : ruby-rack - security update	Nessus	Debian Local Security Checks	2024/4/29	2025/2/17	high

检测

插件搜索

high

high

high

high

high

high

medium

high

high

high