According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible. (CVE-2024-27282)

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible. (CVE-2024-27280)

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible. (CVE-2024-27281)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible.(CVE-2024-27280)

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible.(CVE-2024-27281)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ruby installed on the remote host is prior to 3.0.7 / 3.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-114-01 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-31cac8b8ec advisory.

    Upgrade to Ruby 3.2.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3671 advisory.

    - Fix buffer overread vulnerability in StringIO.
      (CVE-2024-27280)       Resolves: RHEL-37699
    - Fix RCE vulnerability with .rdoc_options in RDoc.
      (CVE-2024-27281)       Resolves: RHEL-37696
    - Fix Arbitrary memory address read vulnerability with Regex search.
      (CVE-2024-27282)       Resolves: RHEL-37698

    rubygem-mysql2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3546 advisory.

    ruby     [3.1.5-143]
    - Upgrade to Ruby 3.1.5.
      Resolves: RHEL-35748
    - Fix buffer overread vulnerability in StringIO.
      Resolves: RHEL-35749
    - Fix RCE vulnerability with .rdoc_options in RDoc.
      Resolves: RHEL-35750
    - Fix arbitrary memory address read vulnerability with Regex search.
      Resolves: RHEL-35751

    rubygem-abrt     rubygem-mysql2     rubygem-pg

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3668 advisory.

    ruby     [3.1.5-144]
    - Upgrade to Ruby 3.1.5.
      Resolves: RHEL-33978
    - Fix buffer overread vulnerability in StringIO.
      Resolves: RHEL-34129
    - Fix RCE vulnerability with .rdoc_options in RDoc.
      Resolves: RHEL-34121
    - Fix arbitrary memory address read vulnerability with Regex search.
      Resolves: RHEL-33871

    [3.1.4-143]
    - Upgrade to Ruby 3.1.4.
      Resolves: RHEL-5586
    - Fix HTTP response splitting in CGI.
      Resolves: RHEL-5591
    - Fix ReDos vulnerability in URI.
      Resolves: RHEL-28919       Resolves: RHEL-5612
    - Fix ReDos vulnerability in Time.
      Resolves: RHEL-28920
    - Make RDoc soft dependency in IRB.
      Resolves: RHEL-5613

    [3.1.2-142]
    - Bypass git submodule test failure on Git >= 2.38.1.
    - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
    - Fix for tzdata-2022g.
    - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
      Resolves: RHEL-5590
    - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters       Related: RHEL-5590
    - Disable fiddle tests that use FFI closures.
      Related: RHEL-5590

    [3.1.2-141]
    - Upgrade to Ruby 3.1.2 by merging Fedora Rawhide branch (commit: b7b5473).
      Resolves: rhbz#2063773

    rubygem-mysql2     [0.5.4-1]
    - New upstream release 0.5.4 by merging Fedora rawhide branch (commit: e21b5b9)       Resolves: rhbz#2063773

    [0.5.3-1]
    - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)       Resolves: rhbz#1817135

    rubygem-pg
    * Thu May 26 2022 Jarek Prokop - 1.3.5-1
    - Update to pg 1.3.5       Related: rhbz#2063773

    [1.2.3-1]
    - Update to pg 1.2.3 by merging Fedora master branch (commit: 5db4d26)       Resolves: rhbz#1817135

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6838-2 advisory.

    USN-6838-1 fixed CVE-2024-27281 in Ruby 2.7, Ruby 3.0, Ruby 3.1, and Ruby 3.2. This update provides the     corresponding updates for Ruby 2.3 and Ruby 2.5.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has ruby packages installed that are affected by multiple vulnerabilities:

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

  - An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When     parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant     remote code execution are possible because there are no restrictions on the classes that can be restored.
    (When loading the documentation cache, object injection and resultant remote code execution are also     possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed     version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed     version is rdoc 6.5.1.1. (CVE-2024-27281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3670 advisory.

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
    * ruby: Arbitrary memory address read vulnerability with Regex search     (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3668 advisory.

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3500 advisory.

    ruby     [3.0.7-143]
    - Fix Zlib test failures on s390x due to HW acceleration       Related: RHEL-36189

    [3.0.7-142]
    - Upgrade to Ruby 3.0.7.
      Resolves: RHEL-36189
    - Fix HTTP response splitting in CGI.
      Resolves: RHEL-36193
    - Fix ReDoS vulnerability in URI.
      Resolves: RHEL-36196
    - Fix ReDoS vulnerability in Time.
      Resolves: RHEL-36205
    - Fix buffer overread vulnerability in StringIO.
      Resolves: RHEL-36198
    - Fix RCE vulnerability with .rdoc_options in RDoc.
      Resolves: RHEL-36200
    - Fix arbitrary memory address read vulnerability with Regex search.
      Resolves: RHEL-36203

    rubygem-abrt     rubygem-mysql2     rubygem-pg

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.102001 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When     parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant     remote code execution are possible because there are no restrictions on the classes that can be restored.
    (When loading the documentation cache, object injection and resultant remote code execution are also     possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed     version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed     version is rdoc 6.5.1.1. (CVE-2024-27281)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3670 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.3). (RHEL-37446)

    Security Fix(es):

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search     (CVE-2024-27282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
205904	EulerOS 2.0 SP12 : ruby (EulerOS-SA-2024-2226)	Nessus	Huawei Local Security Checks	2024/8/20	2024/8/20	critical
205975	EulerOS Virtualization 2.11.0 : ruby (EulerOS-SA-2024-2199)	Nessus	Huawei Local Security Checks	2024/8/21	2024/8/21	critical
193804	Slackware Linux 15.0 / current ruby Multiple Vulnerabilities (SSA:2024-114-01)	Nessus	Slackware Local Security Checks	2024/4/24	2024/7/4	critical
194960	Fedora 39 : ruby (2024-31cac8b8ec)	Nessus	Fedora Local Security Checks	2024/5/3	2024/11/14	medium
200182	Oracle Linux 9 : ruby:3.3 (ELSA-2024-3671)	Nessus	Oracle Linux Local Security Checks	2024/6/7	2024/11/2	critical
200522	Oracle Linux 8 : ruby:3.1 (ELSA-2024-3546)	Nessus	Oracle Linux Local Security Checks	2024/6/14	2024/11/2	critical
200183	Oracle Linux 9 : ruby:3.1 (ELSA-2024-3668)	Nessus	Oracle Linux Local Security Checks	2024/6/7	2024/11/2	critical
215967	Ubuntu 16.04 LTS / 18.04 LTS : Ruby vulnerability (USN-6838-2)	Nessus	Ubuntu Local Security Checks	2025/2/10	2025/2/10	medium
242836	NewStart CGSL MAIN 7.02 : ruby Multiple Vulnerabilities (NS-SA-2025-0116)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	low
200245	AlmaLinux 8 : ruby:3.3 (ALSA-2024:3670)	Nessus	Alma Linux Local Security Checks	2024/6/10	2025/1/13	critical
200164	AlmaLinux 9 : ruby:3.1 (ALSA-2024:3668)	Nessus	Alma Linux Local Security Checks	2024/6/6	2025/1/13	critical
198281	Oracle Linux 8 : ruby:3.0 (ELSA-2024-3500)	Nessus	Oracle Linux Local Security Checks	2024/6/1	2024/11/2	high
208276	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102001)	Nessus	Misc.	2024/10/8	2025/2/20	medium
252858	Linux Distros Unpatched Vulnerability : CVE-2024-27281	Nessus	Misc.	2025/8/20	2025/8/20	medium
200155	RHEL 8 : ruby:3.3 (RHSA-2024:3670)	Nessus	Red Hat Local Security Checks	2024/6/6	2025/4/29	critical

检测

插件搜索

critical

critical

critical

medium

critical

critical

critical

medium

low

critical

critical

high

medium

medium

critical