Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016622 advisory.

    Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard     library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version     2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in     uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical     usage, templates would not normally be read from untrusted user input, but nonetheless, no previous     security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in     Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version     2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to     produce catastrophic backtracking.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard     library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version     2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in     uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical     usage, templates would not normally be read from untrusted user input, but nonetheless, no previous     security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in     Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version     2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to     produce catastrophic backtracking. (CVE-2021-32740)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard
    library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version
    2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in
    uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical
    usage, templates would not normally be read from untrusted user input, but nonetheless, no previous
    security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in
    Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version
    2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to
    produce catastrophic backtracking. (CVE-2021-32740)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4702 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):
    * python-ecdsa: Unexpected and undocumented exceptions during signature decoding (CVE-2019-14853)
    * python-ecdsa: DER encoding is not being verified in signatures (CVE-2019-14859)
    * rubygem-activerecord-session_store: hijack sessions by using timing attacks targeting the session id     (CVE-2019-25025)
    * rake: OS Command Injection via egrep in Rake::FileList (CVE-2020-8130)
    * candlepin: guava - local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)
    * PyYAML: incomplete fix for CVE-2020-1747 (CVE-2020-14343)
    * tfm-rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema (CVE-2020-26247)
    * tfm-rubygem-foreman_azure_rm: Azure compute resource secret_key leak to authenticated users     (CVE-2021-3413)
    * foreman: possible man-in-the-middle in smart_proxy realm_freeipa (CVE-2021-3494)
    * foreman: BMC controller credential leak via API (CVE-2021-20256)
    * python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware (CVE-2021-21330)
    * rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack     (CVE-2021-22885)
    * tfm-rubygem-actionpack: rails: Possible Denial of Service vulnerability in Action Dispatch     (CVE-2021-22902)
    * tfm-rubygem-actionpack: Possible DoS Vulnerability in Action Controller Token Authentication     (CVE-2021-22904)
    * python-django: potential directory-traversal via uploaded files (CVE-2021-28658)
    * tfm-rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS) (CVE-2021-29509)
    * python-django: Potential directory-traversal via uploaded files (CVE-2021-31542)
    * tfm-rubygem-addressable: ReDoS in templates (CVE-2021-32740)
    * python-django: Potential directory traversal via ``admindocs`` (CVE-2021-33203)
    * python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)
    * python-django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros     in IPv4 addresses (CVE-2021-33571)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Updated Content Management backend with Pulp 3 for increased performance, scale and reliability. MongoDB     is also removed from Satellite
    * Adds support for Azure GovCloud
    * Provides Satellite 6.10 Server support for Satellite 6.9 Capsules
    * Improves support for Satellite Air Gapped and Disconnected environments
    * Adds Ansible Collections content type to support disconnected environments
    * Foreman_webhooks introduced to replace foreman_hooks
    * Introduces UI to manage Personal Access Tokens
    * Adds ability to configure Pulp repository synchronization timeouts
    * Support for Convert2RHEL
    * Provides advanced options when registering a host
    * Supports remediation playbook signatures from console.redhat.com
    * Red Hat Insights Plugin replaced through new integration within Satellite
    * Ability to visually represent systems registered and in sync with Insights
    * Ability to verify if required packages are installed as part of pre-upgrade check
    * Ability to unset environment variables when installer is running
    * Ability to turn backups on and off when cleaning up tasks from database

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
316194	Unity Linux 20.1060e / 20.1070e Security Update: rubygem-addressable (UTSA-2026-016622)	Nessus	Unity Linux Local Security Checks	high
259873	Linux Distros Unpatched Vulnerability : CVE-2021-32740	Nessus	Misc.	high
416636	SCA: security update for addressable (GHSA-jxhc-q857-3j6g)	Tenable Cloud Security	SCA Checks	high
416636	SCA: security update for addressable (GHSA-jxhc-q857-3j6g)	Tenable Self-Hosted Container Security	SCA Checks	high
407004	Alpine: ruby-addressable: security update to 2.8.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407004	Alpine: ruby-addressable: security update to 2.8.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
155377	RHEL 7 : Satellite 6.10 Release (Moderate) (RHSA-2021:4702)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2021-32740

high

Tenable Plugins

high

high

high

high

high

high

critical