The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_50773 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-211310)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_50828 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9.8.z] (JIRA:Rocky Linux-171335)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the net-imap Ruby library installed on the remote host is prior to 0.5.15, or 0.6.x prior to 0.6.4.1.
It is, therefore, affected by multiple vulnerabilities.

  - Several Net::IMAP commands accept a raw data argument that is sent verbatim after validation to prevent command     injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject     arbitrary IMAP commands inside non-synchronizing literals. (CVE-2026-47240)

  - Several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and     then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command     to be absorbed as a continuation of the first command, causing a denial of service. (CVE-2026-47241)

  - Two Net::IMAP commands, id and enable, do not validate their arguments. Arguments to either command could be     used by an attacker to inject arbitrary IMAP commands. (CVE-2026-47242)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1667:01 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)
      * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)
      * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
      * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation     (CVE-2026-47242)
      * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_50778 advisory.

    * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input     (CVE-2026-42257)

    * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication     (CVE-2026-42256)

    * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

    * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

    * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

    Bug Fix(es) and Enhancement(s):

    * ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-211300)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
358083	Rocky Linux 10.2 [CIQ] Security Update: ruby4.0 / ruby4.0-debuginfo / ruby4.0-debugsource / ruby4.0-devel / etc Multiple Vulnerabilities (crlsa-2026_50773)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
359098	Rocky Linux 9 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_50828)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
321503	Ruby net-imap < 0.5.15 / 0.6.x < 0.6.4.1 Multiple Vulnerabilities	Nessus	Misc.	2026/6/18	2026/6/26	medium
341076	MiracleLinux 9 : ruby:4.0 (AXSA:2026-1667:01)	Nessus	Miracle Linux Local Security Checks	2026/8/27	2026/8/27	medium
358615	Rocky Linux 10.2 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_50778)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

medium

medium

medium

medium

medium