Detections
Analytics
FreeBSD : Rails -- multiple vulnerabilities (8e670b85-706e-11eb-abb2-08002728f74c)
medium Nessus Plugin ID 146574
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
Ruby on Rails blog :Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those version are security releases and addresses two issues :
CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter.
CVE-2021-22881: Possible Open Redirect in Host Authorization Middleware.
Solution
Update the affected packages.See Also
http://www.nessus.org/u?49f84f54
http://www.nessus.org/u?352e041d
Plugin Details
Severity: Medium
ID: 146574
File Name: freebsd_pkg_8e670b85706e11ebabb208002728f74c.nasl
Version: 1.3
Type: local
Family: FreeBSD Local Security Checks
Published: 2/18/2021
Updated: 1/22/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2021-22881
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:rubygem-actionpack60, p-cpe:/a:freebsd:freebsd:rubygem-actionpack61, p-cpe:/a:freebsd:freebsd:rubygem-activerecord52, p-cpe:/a:freebsd:freebsd:rubygem-activerecord60, p-cpe:/a:freebsd:freebsd:rubygem-activerecord61, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/17/2021
Vulnerability Publication Date: 2/10/2021
Reference Information
CVE: CVE-2021-22880, CVE-2021-22881