Detections
Analytics

Debian dla-4163 : bundler - security update

low Nessus Plugin ID 236773

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4163 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4163-1 [email protected] https://www.debian.org/lts/security/ Lucas Kanashiro May 12, 2025 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : rubygems Version : 3.2.5-2+deb11u1 CVE ID : CVE-2021-43809 CVE-2023-28755 CVE-2025-27221

 Multiple vulnerabilities were found in rubygems, which contains a package management framework for Ruby and a dependency manager for Ruby applications.

 CVE-2021-43809

 In bundler versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables.

 CVE-2023-28755

 A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects.

 CVE-2025-27221

 The URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

 For Debian 11 bullseye, these problems have been fixed in version 3.2.5-2+deb11u1.

 We recommend that you upgrade your rubygems packages.

 For the detailed security status of rubygems please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/rubygems

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the bundler packages.

See Also

https://security-tracker.debian.org/tracker/source-package/rubygems

https://security-tracker.debian.org/tracker/CVE-2021-43809

https://security-tracker.debian.org/tracker/CVE-2023-28755

https://security-tracker.debian.org/tracker/CVE-2025-27221

https://packages.debian.org/source/bullseye/rubygems

Plugin Details

Severity: Low

ID: 236773

File Name: debian_DLA-4163.nasl

Version: 1.1

Type: local

Agent: unix

Published: 5/15/2025

Updated: 5/15/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-43809

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.6

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.1

Threat Score: 1.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

CVSS Score Source: CVE-2025-27221

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:ruby-bundler, p-cpe:/a:debian:debian_linux:ruby-rubygems, p-cpe:/a:debian:debian_linux:bundler, cpe:/o:debian:debian_linux:11.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/12/2025

Vulnerability Publication Date: 12/8/2021

Reference Information

CVE: CVE-2021-43809, CVE-2023-28755, CVE-2025-27221