According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not     properly address XML round-trip issues. An incorrect document can be produced after parsing and     serializing. (CVE-2021-28965)

  - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute     arbitrary code via | and tags in a filename. (CVE-2021-31799)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a 'StartTLS stripping attack.' (CVE-2021-32066)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2584 advisory.

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2588 advisory.

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2588 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

    Security Fix(es):

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains     leading zero [rhel-8] (BZ#1954968)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x     before 2.7.3, and 3.x before 3.0.1 does not properly     address XML round-trip issues. An incorrect document     can be produced after parsing and     serializing.(CVE-2021-28965)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1769:01 advisory.

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)
      * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
156519	EulerOS Virtualization 3.0.2.6 : ruby (EulerOS-SA-2021-2866)	Nessus	Huawei Local Security Checks	1/6/2022	11/21/2023	high
179412	AlmaLinux 8 : ruby:2.7 (ALSA-2021:2584)	Nessus	Alma Linux Local Security Checks	8/7/2023	1/13/2025	high
179413	AlmaLinux 8 : ruby:2.6 (ALSA-2021:2588)	Nessus	Alma Linux Local Security Checks	8/7/2023	1/13/2025	high
151143	RHEL 8 : ruby:2.6 (RHSA-2021:2588)	Nessus	Red Hat Local Security Checks	6/29/2021	1/13/2025	high
151156	EulerOS Virtualization for ARM 64 3.0.6.0 : ruby (EulerOS-SA-2021-2012)	Nessus	Huawei Local Security Checks	6/30/2021	12/12/2023	high
293913	MiracleLinux 7 : rh-ruby27-ruby-2.7.3-129.el7 (AXSA:2021-1769:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high