The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3838 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby     (3.0). (RHEL-35740)

    Security Fix(es):

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)

    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7025 advisory.

    - Fix HTTP response splitting in CGI.
      Resolves: CVE-2021-33621
    - Fix Buffer overrun in String-to-Float conversion.
      Resolves: CVE-2022-28739
    - Fix ReDoS vulnerability in URI.
      Resolves: CVE-2023-28755
    - Fix ReDoS vulnerability in Time.
      Resolves: CVE-2023-28756
    - Fix by adding length limit option for methods that parses date strings.
      Resolves: CVE-2021-41817
    - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security       prefixes in cookie names.
      Resolves: CVE-2021-41819
    - Properly fix command injection vulnerability in Rdoc.
      Related: CVE-2021-31799
    - Fix command injection vulnerability in RDoc.
      Resolves: CVE-2021-31799
    - Fix StartTLS stripping vulnerability in Net::IMAP       Resolves: CVE-2021-32066
    - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
      Resolves: CVE-2021-31810
    - Fix CVE-2013-4073.
    - Fix object taint bypassing in DL and Fiddle (CVE-2013-2065).
    - Fix Hash-flooding DoS vulnerability on MurmurHash function       (CVE-2012-5371)
    - Don't create files when NUL-containing path name is passed       (bug 865940, CVE-2012-4522)
    - Patch from trunk for CVE-2012-4464, CVE-2012-4466
    - Randomize hash on process startup (CVE-2011-4815, bug 750564)
    - CVE-2011-2686 is fixed in this version (bug 722415)
    - CVE-2010-0541 (bug 587731) is fixed in this version
    - CVE-2009-4492 ruby WEBrick log escape sequence (bug 554485)
    - New patchlevel fixing CVE-2009-1904
    - Fix regression in CVE-2008-3790 (#485383)
    - CVE-2008-5189: CGI header injection.
    - CVE-2008-3790: DoS vulnerability in the REXML module.
    - Security fixes.
      - CVE-2008-3655: Ruby does not properly restrict access to critical                        variables and methods at various safe levels.
      - CVE-2008-3656: DoS vulnerability in WEBrick.
      - CVE-2008-3657: Lack of taintness check in dl.
      - CVE-2008-1447: DNS spoofing vulnerability in resolv.rb.
      - CVE-2008-3443: Memory allocation failure in Ruby regex engine.
    - Security fixes. (#452295)
      - CVE-2008-1891: WEBrick CGI source disclosure.
      - CVE-2008-2662: Integer overflow in rb_str_buf_append().
      - CVE-2008-2663: Integer overflow in rb_ary_store().
      - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
      - CVE-2008-2725: Integer overflow in rb_ary_splice().
      - CVE-2008-2726: Integer overflow in rb_ary_splice().
    - ruby-1.8.6.111-CVE-2007-5162.patch: removed.
    - Security fix for CVE-2008-1145.
    - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with backporting the changes        at trunk to enable the fix without any modifications on the users' scripts.
       Note that Net::HTTP#enable_post_connection_check isn't available anymore.
       If you want to disable this post-check, you should give OpenSSL::SSL::VERIFY_NONE        to Net::HTTP#verify_mode= instead of.
    - ruby-1.8.6-CVE-2007-5162.patch: security fix for Net::HTTP that is       insufficient verification of SSL certificate.
    - ruby-1.8.5-cgi-CVE-2006-5467.patch: fix a CGI multipart parsing bug that       causes the denial of service. (#212396)
    - security fixes [CVE-2006-3694]
      - ruby-1.8.4-fix-insecure-dir-operation.patch:
      - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure         operations in the certain safe-level restrictions. (#199538)
      - ruby-1.8.4-fix-alias-safe-level.patch: fixed to not bypass the certain         safe-level restrictions. (#199543)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1431 advisory.

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

  - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles     invalid URLs that have specific characters. There is an increase in execution time for parsing strings to     URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete     fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. (CVE-2023-36617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1576 advisory.

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)
    * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    Bug Fix(es):

    * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-29048)
    * ruby: Ruby cannot read private key in FIPS mode on AlmaLinux 9 (AlmaLinux-12437)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3291 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby27-ruby (2.7.8).
    (BZ#2149267)

    Security Fix(es):

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)

    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6181-1 advisory.

    Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications the     generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the     response a user would receive from a vulnerable application. This issue only affected Ubuntu 22.10.
    (CVE-2021-33621)

    It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly     use this issue to cause a denial of service. (CVE-2023-28755, CVE-2023-28756)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7629:01 advisory.

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
      * ruby: ReDoS vulnerability in URI (CVE-2023-28755)
      * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
      * ruby: ReDoS vulnerability in Time (CVE-2023-28756)     Bug Fix(es):
      * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7662:01 advisory.

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
      * ruby: ReDoS vulnerability in URI (CVE-2023-28755)
      * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
      * ruby: ReDoS vulnerability in Time (CVE-2023-28756)     Bug Fix(es):
      * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (RHEL-29048)
      * ruby: Ruby cannot read private key in FIPS mode on RHEL 9 (RHEL-12437)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4176-1 advisory.

    - CVE-2023-28755: Fixed a ReDoS vulnerability in URI. (bsc#1209891)
    - CVE-2023-28756: Fixed an expensive regexp in the RFC2822 time parser. (bsc#1209967)
    - CVE-2021-41817: Fixed a Regular Expression Denial of Service Vulnerability of Date Parsing Methods.
    (bsc#1193035)
    - CVE-2021-33621: Fixed a HTTP response splitting vulnerability in CGI gem. (bsc#1205726)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
200426	RHEL 9 : ruby (RHSA-2024:3838)	Nessus	Red Hat Local Security Checks	2024/6/12	2026/3/3	high
186102	Oracle Linux 8 : ruby:2.5 (ELSA-2023-7025)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	high
192616	Rocky Linux 8 : ruby:3.1 (RLSA-2024:1431)	Nessus	Rocky Linux Local Security Checks	2024/3/27	2024/3/27	high
192894	AlmaLinux 9 : ruby:3.1 (ALSA-2024:1576)	Nessus	Alma Linux Local Security Checks	2024/4/3	2025/1/13	high
176320	RHEL 7 : rh-ruby27-ruby (RHSA-2023:3291)	Nessus	Red Hat Local Security Checks	2023/5/24	2024/11/7	high
177472	Ubuntu 23.04 : Ruby vulnerabilities (USN-6181-1)	Nessus	Ubuntu Local Security Checks	2023/6/21	2025/9/3	high
293141	MiracleLinux 8 : ruby:3.1 (AXSA:2024-7629:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
293752	MiracleLinux 9 : ruby:3.1 (AXSA:2024-7662:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
183864	SUSE SLED15: libruby2_5-2_5 / ruby2.5 / ruby2.5-devel / ruby2.5-devel-extra / etc (SUSE-SU-2023:4176-1)	Nessus	SuSE Local Security Checks	2023/10/25	2026/6/26	high

检测

插件搜索

high

high

high

high

high

high

high

high

high