Detections
Analytics
SCA: security update for message_bus (GHSA-xmgj-5fh3-xjmm)
medium Tenable Self-Hosted Container Security Plugin ID 420576
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who
deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal
bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain
access to the diagnostic route. The impact is also greater if there is no proxy for your web application
as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact
varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number
of steps up the directories that can be read is limited to 3 levels. This issue has been patched in
version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.
(CVE-2021-43840)
See Also
Plugin Details
Severity: Medium
ID: 420576
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.5
Temporal Score: 2.6
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2021-43840
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 12/17/2021
Vulnerability Publication Date: 12/17/2021
Reference Information
CVE: CVE-2021-43840
cwe: CWE-22