Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0054 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-36327:
    Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the     highest gem version number, which means that a rogue gem found at a public source may be chosen, even if     the intended choice was a private gem that is a dependency of another private gem that is explicitly     depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency     Confusion issue in every product.

    CVE-2021-31799:
    In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute     arbitrary code via | and tags in a filename.

    CVE-2021-31810:
    An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP     server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
    This potentially makes curl extract information about services that are otherwise private and not     disclosed (e.g., the attacker can conduct port scans and service banner extractions).

    CVE-2021-32066:
    An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a StartTLS stripping attack.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1294-1 advisory.

    - CVE-2020-36327: Fixed bundler choosing a dependency source based       on the highest gem version number, which means that a rogue gem       found at a public source may be chosen (bsc#1185842)

    Other fixes:
    - Updated to version 2.2.34

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the     highest gem version number, which means that a rogue gem found at a public source may be chosen, even if     the intended choice was a private gem that is a dependency of another private gem that is explicitly     depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency     Confusion issue in every product. (CVE-2020-36327)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202408-22 (Bundler: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Bundler. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ruby-3.0.2-155.el9 build changelog.

  - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the     highest gem version number, which means that a rogue gem found at a public source may be chosen, even if     the intended choice was a private gem that is a dependency of another private gem that is explicitly     depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency     Confusion issue in every product. (CVE-2020-36327)

  - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute     arbitrary code via | and tags in a filename. (CVE-2021-31799)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP     server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
    This potentially makes curl extract information about services that are otherwise private and not     disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a StartTLS stripping attack. (CVE-2021-32066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0543 advisory.

  - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the     highest gem version number, which means that a rogue gem found at a public source may be chosen, even if     the intended choice was a private gem that is a dependency of another private gem that is explicitly     depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency     Confusion issue in every product. (CVE-2020-36327)

  - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute     arbitrary code via | and tags in a filename. (CVE-2021-31799)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP     server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
    This potentially makes curl extract information about services that are otherwise private and not     disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a StartTLS stripping attack. (CVE-2021-32066)

  - Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via     a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. (CVE-2021-41817)

  - CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects     the CGI gem through 0.3.0 for Ruby. (CVE-2021-41819)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0545 advisory.

  - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the     highest gem version number, which means that a rogue gem found at a public source may be chosen, even if     the intended choice was a private gem that is a dependency of another private gem that is explicitly     depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency     Confusion issue in every product. (CVE-2020-36327)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:0545 advisory.

  - rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:0545 advisory.

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0543 advisory.

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0708 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby26-ruby (2.6.9).
    (BZ#2056947)

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0581 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0582 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0543 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0545 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0544 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0545 advisory.

    rubygem-bundler     [1.16.1-4]
    - Fix Bundler dependency confusion.
      Resolves: CVE-2020-36327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:0543 advisory.

  - rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

  - rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

  - ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

  - ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

  - ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

  - ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0546 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0548 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0543 advisory.

    ruby     [2.6.9-108]
    - Upgrade to Ruby 2.6.9.
    - Skip JIT tests in RHEL 8.
    - Fix the issues required to start the 'make test-bundler' itself.
    - Fix Bundler dependency confusion.
      Resolves: CVE-2020-36327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0547 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3982 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.2).

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3559 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby27-ruby (2.7.4).

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3020 advisory.

  - rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

  - rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

  - ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

  - ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3020 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source     (CVE-2020-36327)

    * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

    * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

    * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3020 advisory.

    ruby     [2.7.4-137]
    - Upgrade to Ruby 2.7.4.
    - Fix command injection vulnerability in RDoc.
      Resolves: rhbz#1986768
    - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
      Resolves: rhbz#1986812
    - Fix StartTLS stripping vulnerability in Net::IMAP.
      Resolves: rhbz#1986813
    - Upgrade to Bundler 2.2.24.
      Resolves: CVE-2020-36327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the rubygem package has been released.

ID	Name	Product	Family	Severity
236695	Alibaba Cloud Linux 3 : 0054: ruby:2.7 (ALINUX3-SA-2021:0054)	Nessus	Alibaba Cloud Linux Local Security Checks	high
234537	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rubygem-bundler (SUSE-SU-2025:1294-1)	Nessus	SuSE Local Security Checks	high
230227	Linux Distros Unpatched Vulnerability : CVE-2020-36327	Nessus	Misc.	high
205347	GLSA-202408-22 : Bundler: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
191258	CentOS 9 : ruby-3.0.2-155.el9	Nessus	CentOS Local Security Checks	high
184813	Rocky Linux 8 : ruby:2.6 (RLSA-2022:0543)	Nessus	Rocky Linux Local Security Checks	high
184688	Rocky Linux 8 : ruby:2.5 (RLSA-2022:0545)	Nessus	Rocky Linux Local Security Checks	high
158988	CentOS 8 : ruby:2.5 (CESA-2022:0545)	Nessus	CentOS Local Security Checks	high
158845	AlmaLinux 8 : ruby:2.5 (ALSA-2022:0545)	Nessus	Alma Linux Local Security Checks	high
158828	AlmaLinux 8 : ruby:2.6 (ALSA-2022:0543)	Nessus	Alma Linux Local Security Checks	high
158464	RHEL 7 : rh-ruby26-ruby (RHSA-2022:0708)	Nessus	Red Hat Local Security Checks	high
158216	RHEL 8 : ruby:2.6 (RHSA-2022:0581)	Nessus	Red Hat Local Security Checks	high
158215	RHEL 8 : ruby:2.6 (RHSA-2022:0582)	Nessus	Red Hat Local Security Checks	high
158132	RHEL 8 : ruby:2.6 (RHSA-2022:0543)	Nessus	Red Hat Local Security Checks	high
158129	RHEL 8 : ruby:2.5 (RHSA-2022:0545)	Nessus	Red Hat Local Security Checks	high
158120	RHEL 8 : ruby:2.6 (RHSA-2022:0544)	Nessus	Red Hat Local Security Checks	high
158118	Oracle Linux 8 : ruby:2.5 (ELSA-2022-0545)	Nessus	Oracle Linux Local Security Checks	high
158117	CentOS 8 : ruby:2.6 (CESA-2022:0543)	Nessus	CentOS Local Security Checks	high
158116	RHEL 8 : ruby:2.5 (RHSA-2022:0546)	Nessus	Red Hat Local Security Checks	high
158115	RHEL 8 : ruby:2.5 (RHSA-2022:0548)	Nessus	Red Hat Local Security Checks	high
158114	Oracle Linux 8 : ruby:2.6 (ELSA-2022-0543)	Nessus	Oracle Linux Local Security Checks	high
158106	RHEL 8 : ruby:2.5 (RHSA-2022:0547)	Nessus	Red Hat Local Security Checks	high
154437	RHEL 7 : rh-ruby30-ruby (RHSA-2021:3982)	Nessus	Red Hat Local Security Checks	high
153513	RHEL 7 : rh-ruby27-ruby (RHSA-2021:3559)	Nessus	Red Hat Local Security Checks	high
152359	CentOS 8 : ruby:2.7 (CESA-2021:3020)	Nessus	CentOS Local Security Checks	high
152354	RHEL 8 : ruby:2.7 (RHSA-2021:3020)	Nessus	Red Hat Local Security Checks	high
152264	Oracle Linux 8 : ruby:2.7 (ELSA-2021-3020)	Nessus	Oracle Linux Local Security Checks	high
151947	Photon OS 4.0: Rubygem PHSA-2021-4.0-0060	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-36327

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high