A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3298 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3298-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     January 31, 2023                            https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ruby-rack     Version        : 2.0.6-3+deb10u2     CVE ID         : CVE-2020-8161 CVE-2020-8184 CVE-2022-44570                      CVE-2022-44571 CVE-2022-44572     Debian Bug     : 963477 1029832

    Several vulnerabilities, like directory traversal vulnerability,     ReDoS vulnerability, et al, were found in ruby-rack, a modular Ruby     webserver interface.

    For Debian 10 buster, these problems have been fixed in version     2.0.6-3+deb10u2.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3347-1 advisory.

  - A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory     traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in     information disclosure. (CVE-2020-8161)

  - A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3,     rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
    (CVE-2020-8184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4561-2 advisory.

    USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04     LTS, Ubuntu 20.04 LTS and Ubuntu 20.10.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)
    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
    * rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)
    * puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)
    * jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547     CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)
    * foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)
    * Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover     (CVE-2020-14380)
    * Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)
    * rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)
    * rubygem-secure_headers: limited header injection when using dynamic overrides with user input     (CVE-2020-5216)
    * rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)
    * rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks     (CVE-2020-5267)
    * puppet: Arbitrary catalog retrieval (CVE-2020-7942)
    * rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)
    * rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names     (CVE-2020-8184)
    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)
    * puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL     (CVE-2018-11751)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration     and deployment.

    * Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment

    * Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with     a single job execution.

    * Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet

    * Support for HTTP UEFI provisioning

    * Support for CAC card authentication with Keycloak integration

    * Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.

    * Support for Red Hat Enterprise Linux Traces integration

    * satellite-maintain & foreman-maintain are now self updating

    * Notifications in the UI to warn users when subscriptions are expiring.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4561-1 advisory.

    It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue     to obtain sensitive information. (CVE-2020-8161)

    It was discovered that Rack incorrectly validated cookies. An attacker could possibly use this issue to     forge a secure cookie. (CVE-2020-8184)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following CVEs were reported against src:ruby-rack.

CVE-2020-8161

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

CVE-2020-8184

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

For Debian 9 stretch, these problems have been fixed in version 1.6.4-4+deb9u2.

We recommend that you upgrade your ruby-rack packages.

For the detailed security status of ruby-rack please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-rack

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack.

If certain directories exist in a director that is managed by `Rack::Directory`, an attacker could, using this vulnerability, read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer.

For Debian 8 'Jessie', this problem has been fixed in version 1.5.2-3+deb8u3.

We recommend that you upgrade your ruby-rack packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
170885	Debian dla-3298 : ruby-rack - security update	Nessus	Debian Local Security Checks	high
165418	SUSE SLES15 Security Update : rubygem-rack (SUSE-SU-2022:3347-1)	Nessus	SuSE Local Security Checks	high
148334	Ubuntu 16.04 LTS / 20.04 LTS : Rack vulnerabilities (USN-4561-2)	Nessus	Ubuntu Local Security Checks	high
142452	RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)	Nessus	Red Hat Local Security Checks	critical
141097	Ubuntu 18.04 LTS : Rack vulnerabilities (USN-4561-1)	Nessus	Ubuntu Local Security Checks	high
138389	Debian DLA-2275-1 : ruby-rack security update	Nessus	Debian Local Security Checks	high
136832	Debian DLA-2216-1 : ruby-rack security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-8161

high

Tenable Plugins

high

high

high

critical

high

high

high