An update of the ruby package has been released.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3858 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3858-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     September 02, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby2.7     Version        : 2.7.4-1+deb11u2     CVE ID         : CVE-2021-33621 CVE-2022-28739 CVE-2023-28755 CVE-2023-28756                      CVE-2023-36617 CVE-2024-27280 CVE-2024-27281 CVE-2024-27282     Debian Bug     : 1009957 1024799 1038408 1067802 1069966 1069968

    Several vulnerabilities have been discovered in the interpreter for     the Ruby language, which may result in denial-of-service (DoS),     information leak, and remote code execution.

    CVE-2021-33621

        The cgi gem allows HTTP response splitting. This is relevant to         applications that use untrusted user input either to generate an         HTTP response or to create a CGI::Cookie object.

    CVE-2022-28739

        Buffer over-read occurs in String-to-Float conversion, including         Kernel#Float and String#to_f.

    CVE-2023-28755

        A ReDoS issue was discovered in the URI component. The URI parser         mishandles invalid URLs that have specific characters. It causes         an increase in execution time for parsing strings to URI objects.

    CVE-2023-28756

        A ReDoS issue was discovered in the Time component. The Time         parser mishandles invalid URLs that have specific characters. It         causes an increase in execution time for parsing strings to Time         objects.

    CVE-2023-36617

        Follow-up fix for CVE-2023-28755.

    CVE-2024-27280

        A buffer-overread issue was discovered in StringIO. The ungetbyte         and ungetc methods on a StringIO can read past the end of a         string, and a subsequent call to StringIO.gets may return the         memory value.

    CVE-2024-27281

        When parsing .rdoc_options (used for configuration in RDoc) as a         YAML file, object injection and resultant remote code execution         are possible because there are no restrictions on the classes that         can be restored. (When loading the documentation cache, object         injection and resultant remote code execution are also possible if         there were a crafted cache.)

    CVE-2024-27282

        If attacker-supplied data is provided to the Ruby regex compiler,         it is possible to extract arbitrary heap data relative to the         start of the text, including pointers and sensitive strings.

    For Debian 11 bullseye, these problems have been fixed in version     2.7.4-1+deb11u2.

    We recommend that you upgrade your ruby2.7 packages.

    For the detailed security status of ruby2.7 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby2.7

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3500 advisory.

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)

    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

    * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

    * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202401-27 (Ruby: Multiple vulnerabilities)

  - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a     simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An     attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header     check), which may lead to an HTTP Request Smuggling attack. (CVE-2020-25613)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP     server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
    This potentially makes curl extract information about services that are otherwise private and not     disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a StartTLS stripping attack. (CVE-2021-32066)

  - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response     splitting. This is relevant to applications that use untrusted user input either to generate an HTTP     response or to create a CGI::Cookie object. (CVE-2021-33621)

  - CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer     overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of     bytes. This also affects the CGI gem before 0.3.1 for Ruby. (CVE-2021-41816)

  - Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via     a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. (CVE-2021-41817)

  - CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects     the CGI gem through 0.3.0 for Ruby. (CVE-2021-41819)

  - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a     victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to     unexpected memory locations. (CVE-2022-28738)

  - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before     3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. (CVE-2022-28739)

  - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

  - A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser     mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing     strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204266	Photon OS 5.0: Ruby PHSA-2024-5.0-0247	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	medium
206420	Debian dla-3858 : libruby2.7 - security update	Nessus	Debian Local Security Checks	9/2/2024	9/2/2024	high
235504	RockyLinux 8 : ruby:3.0 (RLSA-2024:3500)	Nessus	Rocky Linux Local Security Checks	5/7/2025	5/7/2025	high
189405	GLSA-202401-27 : Ruby: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2024	1/24/2024	critical

Detections

Analytics

Plugins Search

medium

high

high

critical