The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.216 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a     denial of service via a crafted script. (CVE-2020-24736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 84ab03b6-6c20-11ed-b519-080027f5fec9 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ruby package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:3821 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1576 advisory.

    ruby     [3.1.4-143]
    - Upgrade to Ruby 3.1.4.
      Resolves: RHEL-5586
    - Fix HTTP response splitting in CGI.
      Resolves: RHEL-5591
    - Fix ReDos vulnerability in URI.
      Resolves: RHEL-28919       Resolves: RHEL-5612
    - Fix ReDos vulnerability in Time.
      Resolves: RHEL-28920
    - Make RDoc soft dependency in IRB.
      Resolves: RHEL-5613

    [3.1.2-142]
    - Bypass git submodule test failure on Git >= 2.38.1.
    - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
    - Fix for tzdata-2022g.
    - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
      Resolves: RHEL-5590
    - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters       Related: RHEL-5590
    - Disable fiddle tests that use FFI closures.
      Related: RHEL-5590

    rubygem-mysql2     [0.5.4-1]
    - New upstream release 0.5.4 by merging Fedora rawhide branch (commit: e21b5b9)       Resolves: rhbz#2063773

    [0.5.3-1]
    - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)       Resolves: rhbz#1817135

    rubygem-pg     [1.3.5-1]
    - Update to pg 1.3.5       Related: rhbz#2063773

    [1.2.3-1]
    - Update to pg 1.2.3 by merging Fedora master branch (commit: 5db4d26)       Resolves: rhbz#1817135

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ruby package has been released.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-f0f6c6bec2 advisory.

    Upgrade to Ruby 3.1.3.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3450 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3450-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     June 09, 2023                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ruby2.5     Version        : 2.5.5-3+deb10u6     CVE ID         : CVE-2021-33621 CVE-2022-28739     Debian Bug     : 1009957 1024800 1037178

    A couple of security issues were discovered in ruby2.5, the Ruby     interpreter, and are as follows -

    CVE-2021-33621

        Hiroshi Tokumaru discovered that Ruby did not properly handle         certain user input for applications the generate HTTP responses         using cgi gem. An attacker could possibly use this issue to         maliciously modify the response a user would receive from a         vulnerable application.

    CVE-2022-28739

        It was discovered that Ruby incorrectly handled certain inputs.
        An attacker could possibly use this issue to expose sensitive         information.

    For Debian 10 buster, these problems have been fixed, along with the     regressions caused by the last Ruby update, in version 2.5.5-3+deb10u6.

    We recommend that you upgrade your ruby2.5 packages.

    For the detailed security status of ruby2.5 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby2.5

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0312 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2021-33621:
      The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object.

      CVE-2022-28739:
      There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x     before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

      CVE-2023-28755:
      A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

      CVE-2023-28756:
      A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0106 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2021-33621:
    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object.

    CVE-2023-28755:
    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

    CVE-2023-28756:
    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

    CVE-2023-36617:
    A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0080 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-33621:
    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object.

    CVE-2023-28755:
    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

    CVE-2021-41817:
    Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via     a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

    CVE-2021-41819:
    CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects     the CGI gem through 0.3.0 for Ruby.

    CVE-2022-28739:
    There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

    CVE-2023-28756:
    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.207 advisory.

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

  - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the     attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content     to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing     filenames with two or more newlines where selected content and the target file names are embedded in     crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write     arbitrary files on the system. (CVE-2022-1271)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116. (CVE-2020-26137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
252541	Linux Distros Unpatched Vulnerability : CVE-2021-33621	Nessus	Misc.	2025/8/20	2026/4/28	high
181785	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.216)	Nessus	Misc.	2023/9/22	2025/2/19	critical
168188	FreeBSD : rubygem-cgi -- HTTP response splitting vulnerability (84ab03b6-6c20-11ed-b519-080027f5fec9)	Nessus	FreeBSD Local Security Checks	2022/11/25	2023/9/20	high
172322	EulerOS 2.0 SP9 : ruby (EulerOS-SA-2023-1458)	Nessus	Huawei Local Security Checks	2023/3/8	2023/8/31	high
172730	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2023-1565)	Nessus	Huawei Local Security Checks	2023/3/19	2023/8/30	high
177151	EulerOS Virtualization 3.0.6.0 : ruby (EulerOS-SA-2023-2248)	Nessus	Huawei Local Security Checks	2023/6/13	2023/6/13	high
180403	Rocky Linux 8 : ruby:2.7 (RLSA-2023:3821)	Nessus	Rocky Linux Local Security Checks	2023/8/31	2023/11/6	high
192872	Oracle Linux 9 : ruby:3.1 (ELSA-2024-1576)	Nessus	Oracle Linux Local Security Checks	2024/4/2	2025/9/9	high
204435	Photon OS 5.0: Ruby PHSA-2024-5.0-0221	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
204551	Photon OS 4.0: Ruby PHSA-2024-4.0-0562	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
211157	Fedora 37 : ruby (2022-f0f6c6bec2)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
214476	Debian dla-3450 : libruby2.5 - security update	Nessus	Debian Local Security Checks	2025/1/22	2025/1/22	high
276331	TencentOS Server 3: ruby:2.5 (TSSA-2023:0312)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/5	high
276361	TencentOS Server 3: ruby:3.1 (TSSA-2024:0106)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/4	high
236688	Alibaba Cloud Linux 3 : 0080: ruby:2.7 (ALINUX3-SA-2023:0080)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
180469	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.207)	Nessus	Misc.	2023/9/4	2026/1/21	low

检测

插件搜索

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

low