Detections
Analytics
Debian DLA-3360-1 : ruby-sidekiq - LTS security update
medium Nessus Plugin ID 172486
Language:
Synopsis
The remote Debian host is missing one or more security-related updates.Description
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3360 advisory.- Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. (CVE-2021-30151)
- In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
(CVE-2022-23837)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the ruby-sidekiq packages.For Debian 10 buster, these problems have been fixed in version 5.2.3+dfsg-1+deb10u1.
See Also
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987354
http://www.nessus.org/u?b88f20f6
https://www.debian.org/lts/security/2023/dla-3360
https://security-tracker.debian.org/tracker/CVE-2021-30151
Plugin Details
Severity: Medium
ID: 172486
File Name: debian_DLA-3360.nasl
Version: 1.1
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 3/12/2023
Updated: 8/30/2023
Supported Sensors: Nessus Agent, Agentless Assessment, Frictionless Assessment Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2021-30151
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:ruby-sidekiq, cpe:/o:debian:debian_linux:10.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/13/2023
Vulnerability Publication Date: 4/6/2021
Reference Information
CVE: CVE-2021-30151, CVE-2022-23837