The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0542 advisory.

  - ruby: DoS by large request in WEBrick (CVE-2018-8777)

  - ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780)

  - rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073)

  - rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on     specially crafted YAML (CVE-2018-1000074)

  - rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service     (CVE-2018-1000075)

  - rubygems: Improper verification of signatures in tarball allows to install mis-signed gem     (CVE-2018-1000076)

  - rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage     URL (CVE-2018-1000077)

  - rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078)

  - rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations     (CVE-2018-1000079)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : ruby (RHSA-2020:0542)

critical Nessus Plugin ID 133785

Version 1.10

Version 1.9

Version 1.8

Version 1.10 Apr 28, 2024, 3:17 AM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404280317
Version 1.9 May 25, 2023, 5:09 PM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305251709
Version 1.8 Jan 23, 2023, 7:12 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301231912