According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible.(CVE-2024-27280)

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many     features to process text files and to do system management tasks (as in Perl). It is simple, straight-     forward, and extensible.(CVE-2024-27281)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4499 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-31cac8b8ec advisory.

    Upgrade to Ruby 3.2.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-48bdd3abbf advisory.

    Upgrade to Ruby 3.2.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ruby package has been released.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5677 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5677-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 03, 2024                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ruby3.1     CVE ID         : CVE-2024-27280 CVE-2024-27281 CVE-2024-27282

    Several vulnerabilities have been discovered in the interpreter for     the Ruby language, which may result in information disclosure, denial     of service or the execution of arbitrary code.

    For the stable distribution (bookworm), these problems have been fixed in     version 3.1.2-7+deb12u1.

    We recommend that you upgrade your ruby3.1 packages.

    For the detailed security status of ruby3.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby3.1

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3546 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3670 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.3). (RHEL-37446)

    Security Fix(es):

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search     (CVE-2024-27282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3671 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.3). (RHEL-37697)

    Security Fix(es):

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3670 advisory.

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
    * ruby: Arbitrary memory address read vulnerability with Regex search     (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4499 advisory.

    * rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    * REXML: DoS parsing an XML with many `<`s in an attribute value (CVE-2024-35176)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8491:01 advisory.

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
      * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
      * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7. It is, therefore, affected by multiple vulnerabilities:

  - This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7,     macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access sensitive user data. (CVE-2025-43308)

  - A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and     3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and     a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however,     for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is     stringio 3.0.1.2. (CVE-2024-27280)

  - A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma     14.8, macOS Tahoe 26. An app may be able to access sensitive user data. (CVE-2025-24197)

  - An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and     iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, watchOS 26. An app may be able     to access sensitive user data. (CVE-2025-31255)

  - A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS     Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to capture a screenshot of an app     entering or exiting full screen mode. (CVE-2025-31259)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
200957	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2024-1825)	Nessus	Huawei Local Security Checks	2024/6/25	2024/7/3	critical
202189	RHEL 8 : ruby (RHSA-2024:4499)	Nessus	Red Hat Local Security Checks	2024/7/11	2025/4/8	medium
194960	Fedora 39 : ruby (2024-31cac8b8ec)	Nessus	Fedora Local Security Checks	2024/5/3	2024/11/14	medium
194967	Fedora 38 : ruby (2024-48bdd3abbf)	Nessus	Fedora Local Security Checks	2024/5/4	2024/11/14	medium
204266	Photon OS 5.0: Ruby PHSA-2024-5.0-0247	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
194971	Debian dsa-5677 : libruby3.1 - security update	Nessus	Debian Local Security Checks	2024/5/4	2025/1/24	critical
200061	RHEL 8 : ruby:3.1 (RHSA-2024:3546)	Nessus	Red Hat Local Security Checks	2024/6/3	2025/4/29	critical
200155	RHEL 8 : ruby:3.3 (RHSA-2024:3670)	Nessus	Red Hat Local Security Checks	2024/6/6	2025/4/29	critical
200168	RHEL 9 : ruby:3.3 (RHSA-2024:3671)	Nessus	Red Hat Local Security Checks	2024/6/6	2025/4/29	critical
200245	AlmaLinux 8 : ruby:3.3 (ALSA-2024:3670)	Nessus	Alma Linux Local Security Checks	2024/6/10	2025/1/13	critical
202386	Rocky Linux 8 : ruby (RLSA-2024:4499)	Nessus	Rocky Linux Local Security Checks	2024/7/15	2024/12/23	medium
292631	MiracleLinux 9 : ruby:3.3 (AXSA:2024-8491:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
264812	macOS 15.x < 15.7 Multiple Vulnerabilities (125111)	Nessus	MacOS X Local Security Checks	2025/9/15	2026/5/26	critical

检测

插件搜索

critical

medium

medium

medium

medium

critical

critical

critical

critical

critical

medium

critical

critical