Detections
Analytics
Alpine: multiple ruby packages: security update to 2.5.0-r1 (deprecated)
critical Tenable Cloud Security Plugin ID 400746
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the
corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780)
- Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows
an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response
for the HTTP server of WEBrick. (CVE-2017-17742)
- Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10,
2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to
create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914)
- In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to
WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777)
- In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer
under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
(CVE-2018-8778)
See Also
https://git.alpinelinux.org/aports/commit/?id=56f7223fa0f34b764b51fb8a843bd102586aec11
https://git.alpinelinux.org/aports/commit/?id=8e71f2e5fdb9d522368ddca664bf4a3f68864028
Plugin Details
Severity: Critical
ID: 400746
Version: Revision 1.25
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-8780
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/29/2018
Vulnerability Publication Date: 3/28/2018
Reference Information
CVE: CVE-2017-17742, CVE-2018-6914, CVE-2018-8777, CVE-2018-8778, CVE-2018-8779, CVE-2018-8780