The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-48bdd3abbf advisory.

    Upgrade to Ruby 3.2.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5677 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5677-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 03, 2024                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ruby3.1     CVE ID         : CVE-2024-27280 CVE-2024-27281 CVE-2024-27282

    Several vulnerabilities have been discovered in the interpreter for     the Ruby language, which may result in information disclosure, denial     of service or the execution of arbitrary code.

    For the stable distribution (bookworm), these problems have been fixed in     version 3.1.2-7+deb12u1.

    We recommend that you upgrade your ruby3.1 packages.

    For the detailed security status of ruby3.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby3.1

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3546 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3670 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.3). (RHEL-37446)

    Security Fix(es):

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search     (CVE-2024-27282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3671 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.3). (RHEL-37697)

    Security Fix(es):

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3670 advisory.

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
    * ruby: Arbitrary memory address read vulnerability with Regex search     (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8491:01 advisory.

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
      * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
      * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
194967	Fedora 38 : ruby (2024-48bdd3abbf)	Nessus	Fedora Local Security Checks	2024/5/4	2024/11/14	medium
194971	Debian dsa-5677 : libruby3.1 - security update	Nessus	Debian Local Security Checks	2024/5/4	2025/1/24	critical
200061	RHEL 8 : ruby:3.1 (RHSA-2024:3546)	Nessus	Red Hat Local Security Checks	2024/6/3	2025/4/29	critical
200155	RHEL 8 : ruby:3.3 (RHSA-2024:3670)	Nessus	Red Hat Local Security Checks	2024/6/6	2025/4/29	critical
200168	RHEL 9 : ruby:3.3 (RHSA-2024:3671)	Nessus	Red Hat Local Security Checks	2024/6/6	2025/4/29	critical
200245	AlmaLinux 8 : ruby:3.3 (ALSA-2024:3670)	Nessus	Alma Linux Local Security Checks	2024/6/10	2025/1/13	critical
292631	MiracleLinux 9 : ruby:3.3 (AXSA:2024-8491:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

medium

critical

critical

critical

critical

critical

critical