Vulnerabilities > CVE-2018-8777 - Resource Exhaustion vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
ruby-lang
debian
canonical
redhat
CWE-400
nessus

Summary

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).

Common Attack Pattern Enumeration and Classification (CAPEC)

  • XML Ping of the Death
    An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
  • XML Entity Expansion
    An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
  • Inducing Account Lockout
    An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
  • Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
    XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

Nessus

  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0221_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ruby packages installed that are affected by multiple vulnerabilities: - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. (CVE-2018-8778) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780) - Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. (CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. (CVE-2018-16396) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. (CVE-2018-8779) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id131412
    published2019-12-02
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131412
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0221)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0221. The text
    # itself is copyright (C) ZTE, Inc.
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131412);
      script_version("1.2");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2017-17742",
        "CVE-2018-6914",
        "CVE-2018-8777",
        "CVE-2018-8778",
        "CVE-2018-8779",
        "CVE-2018-8780",
        "CVE-2018-16396",
        "CVE-2018-1000073",
        "CVE-2018-1000074",
        "CVE-2018-1000075",
        "CVE-2018-1000076",
        "CVE-2018-1000077",
        "CVE-2018-1000078",
        "CVE-2018-1000079"
      );
      script_bugtraq_id(
        103683,
        103684,
        103686,
        103693,
        103739,
        103767,
        105955
      );
    
      script_name(english:"NewStart CGSL CORE 5.04 / MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0221)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ruby packages installed that are affected by
    multiple vulnerabilities:
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
        attacker controlling the unpacking format (similar to
        format string vulnerabilities) can trigger a buffer
        under-read in the String#unpack method, resulting in a
        massive and controlled information disclosure.
        (CVE-2018-8778)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Directory
        Traversal vulnerability in install_location function of
        package.rb that can result in path traversal when
        writing to a symlinked basedir outside of the root. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000073)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
        Dir.open, Dir.new, Dir.entries and Dir.empty? methods do
        not check NULL characters. When using the corresponding
        method, unintentional directory traversal may be
        performed. (CVE-2018-8780)
    
      - Directory traversal vulnerability in the Dir.mktmpdir
        method in the tmpdir library in Ruby before 2.2.10,
        2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before
        2.5.1, and 2.6.0-preview1 might allow attackers to
        create arbitrary directories or files via a .. (dot dot)
        in the prefix argument. (CVE-2018-6914)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
        attacker can pass a large HTTP request with a crafted
        header to WEBrick server or a crafted body to WEBrick
        server/handler and cause a denial of service (memory
        consumption). (CVE-2018-8777)
    
      - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an
        HTTP Response Splitting attack. An attacker can inject a
        crafted key and value into an HTTP response for the HTTP
        server of WEBrick. (CVE-2017-17742)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Deserialization
        of Untrusted Data vulnerability in owner command that
        can result in code execution. This attack appear to be
        exploitable via victim must run the `gem owner` command
        on a gem with a specially crafted YAML file. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000074)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Cross Site
        Scripting (XSS) vulnerability in gem server display of
        homepage attribute that can result in XSS. This attack
        appear to be exploitable via the victim must browse to a
        malicious gem on a vulnerable gem server. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000078)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Directory
        Traversal vulnerability in gem installation that can
        result in the gem could write to arbitrary filesystem
        locations during installation. This attack appear to be
        exploitable via the victim must install a malicious gem.
        This vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000079)
    
      - An issue was discovered in Ruby before 2.3.8, 2.4.x
        before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before
        2.6.0-preview3. It does not taint strings that result
        from unpacking tainted strings with some formats.
        (CVE-2018-16396)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
        UNIXServer.open and UNIXSocket.open methods are not
        checked for null characters. It may be connected to an
        unintended socket. (CVE-2018-8779)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a infinite loop
        caused by negative size vulnerability in ruby gem
        package tar header that can result in a negative size
        could cause an infinite loop.. This vulnerability
        appears to have been fixed in 2.7.6. (CVE-2018-1000075)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Improper
        Verification of Cryptographic Signature vulnerability in
        package.rb that can result in a mis-signed gem could be
        installed, as the tarball would contain multiple gem
        signatures.. This vulnerability appears to have been
        fixed in 2.7.6. (CVE-2018-1000076)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Improper Input
        Validation vulnerability in ruby gems specification
        homepage attribute that can result in a malicious gem
        could set an invalid homepage URL. This vulnerability
        appears to have been fixed in 2.7.6. (CVE-2018-1000077)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0221");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL ruby packages. Note that updated packages may not be available yet. Please contact ZTE for
    more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8780");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/11/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/02");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.04" &&
        release !~ "CGSL MAIN 5.04")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.04": [
        "ruby-2.0.0.648-36.el7",
        "ruby-debuginfo-2.0.0.648-36.el7",
        "ruby-devel-2.0.0.648-36.el7",
        "ruby-doc-2.0.0.648-36.el7",
        "ruby-irb-2.0.0.648-36.el7",
        "ruby-libs-2.0.0.648-36.el7",
        "ruby-tcltk-2.0.0.648-36.el7",
        "rubygem-bigdecimal-1.2.0-36.el7",
        "rubygem-io-console-0.4.2-36.el7",
        "rubygem-json-1.7.7-36.el7",
        "rubygem-minitest-4.3.2-36.el7",
        "rubygem-psych-2.0.0-36.el7",
        "rubygem-rake-0.9.6-36.el7",
        "rubygem-rdoc-4.0.0-36.el7",
        "rubygems-2.0.14.1-36.el7",
        "rubygems-devel-2.0.14.1-36.el7"
      ],
      "CGSL MAIN 5.04": [
        "ruby-2.0.0.648-36.el7",
        "ruby-debuginfo-2.0.0.648-36.el7",
        "ruby-devel-2.0.0.648-36.el7",
        "ruby-doc-2.0.0.648-36.el7",
        "ruby-irb-2.0.0.648-36.el7",
        "ruby-libs-2.0.0.648-36.el7",
        "ruby-tcltk-2.0.0.648-36.el7",
        "rubygem-bigdecimal-1.2.0-36.el7",
        "rubygem-io-console-0.4.2-36.el7",
        "rubygem-json-1.7.7-36.el7",
        "rubygem-minitest-4.3.2-36.el7",
        "rubygem-psych-2.0.0-36.el7",
        "rubygem-rake-0.9.6-36.el7",
        "rubygem-rdoc-4.0.0-36.el7",
        "rubygems-2.0.14.1-36.el7",
        "rubygems-devel-2.0.14.1-36.el7"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3685-1.NASL
    descriptionSome of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to overwrite any file on the filesystem. (CVE-2017-0901) It was discovered that Ruby was vulnerable to a DNS hijacking vulnerability. An attacker could use this to possibly force the RubyGems client to download and install gems from a server that the attacker controls. (CVE-2017-0902) It was discovered that Ruby incorrectly handled certain YAML files. An attacker could use this to possibly execute arbitrary code. (CVE-2017-0903) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to expose sensitive information. (CVE-2017-14064) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to execute arbitrary code. (CVE-2017-10784) It was discovered that Ruby incorrectly handled certain network requests. An attacker could possibly use this to inject a crafted key into a HTTP response. (CVE-2017-17742) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. This update is only addressed to ruby2.0. (CVE-2018-1000074) It was discovered that Ruby incorrectly handled certain network requests. An attacker could possibly use this to cause a denial of service. (CVE-2018-8777). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id110551
    published2018-06-15
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110551
    titleUbuntu 14.04 LTS / 16.04 LTS / 17.10 : ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities (USN-3685-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-3685-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110551);
      script_version("1.4");
      script_cvs_date("Date: 2019/09/18 12:31:48");
    
      script_cve_id("CVE-2017-0898", "CVE-2017-0901", "CVE-2017-0902", "CVE-2017-0903", "CVE-2017-10784", "CVE-2017-14064", "CVE-2017-17742", "CVE-2018-1000074", "CVE-2018-8777");
      script_xref(name:"USN", value:"3685-1");
    
      script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities (USN-3685-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Some of these CVE were already addressed in previous USN: 3439-1,
    3553-1, 3528-1. Here we address for the remain releases.
    
    It was discovered that Ruby incorrectly handled certain inputs. An
    attacker could use this to cause a buffer overrun. (CVE-2017-0898)
    
    It was discovered that Ruby incorrectly handled certain files. An
    attacker could use this to overwrite any file on the filesystem.
    (CVE-2017-0901)
    
    It was discovered that Ruby was vulnerable to a DNS hijacking
    vulnerability. An attacker could use this to possibly force the
    RubyGems client to download and install gems from a server that the
    attacker controls. (CVE-2017-0902)
    
    It was discovered that Ruby incorrectly handled certain YAML files. An
    attacker could use this to possibly execute arbitrary code.
    (CVE-2017-0903)
    
    It was discovered that Ruby incorrectly handled certain files. An
    attacker could use this to expose sensitive information.
    (CVE-2017-14064)
    
    It was discovered that Ruby incorrectly handled certain inputs. An
    attacker could use this to execute arbitrary code. (CVE-2017-10784)
    
    It was discovered that Ruby incorrectly handled certain network
    requests. An attacker could possibly use this to inject a crafted key
    into a HTTP response. (CVE-2017-17742)
    
    It was discovered that Ruby incorrectly handled certain files. An
    attacker could possibly use this to execute arbitrary code. This
    update is only addressed to ruby2.0. (CVE-2018-1000074)
    
    It was discovered that Ruby incorrectly handled certain network
    requests. An attacker could possibly use this to cause a denial of
    service. (CVE-2018-8777).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/3685-1/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libruby1.9.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libruby2.0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libruby2.3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ruby1.9.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ruby1.9.3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ruby2.0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ruby2.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:17.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/06/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/06/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(14\.04|16\.04|17\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 17.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"14.04", pkgname:"libruby1.9.1", pkgver:"1.9.3.484-2ubuntu1.12")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"libruby2.0", pkgver:"2.0.0.484-1ubuntu2.10")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"ruby1.9.1", pkgver:"1.9.3.484-2ubuntu1.12")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"ruby1.9.3", pkgver:"1.9.3.484-2ubuntu1.12")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"ruby2.0", pkgver:"2.0.0.484-1ubuntu2.10")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"libruby2.3", pkgver:"2.3.1-2~16.04.10")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"ruby2.3", pkgver:"2.3.1-2~16.04.10")) flag++;
    if (ubuntu_check(osver:"17.10", pkgname:"libruby2.3", pkgver:"2.3.3-1ubuntu1.6")) flag++;
    if (ubuntu_check(osver:"17.10", pkgname:"ruby2.3", pkgver:"2.3.3-1ubuntu1.6")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libruby1.9.1 / libruby2.0 / libruby2.3 / ruby1.9.1 / ruby1.9.3 / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1804-1.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: Fixed Net::POPMail methods modify frozen literal when using default arg ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: Add a new helper for bundled ruby gems. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126617
    published2019-07-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126617
    titleSUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2019:1804-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(126617);
      script_version("1.3");
      script_cvs_date("Date: 2020/01/08");
    
      script_cve_id("CVE-2017-17742", "CVE-2018-1000073", "CVE-2018-1000074", "CVE-2018-1000075", "CVE-2018-1000076", "CVE-2018-1000077", "CVE-2018-1000078", "CVE-2018-1000079", "CVE-2018-16395", "CVE-2018-16396", "CVE-2018-6914", "CVE-2018-8777", "CVE-2018-8778", "CVE-2018-8779", "CVE-2018-8780", "CVE-2019-8320", "CVE-2019-8321", "CVE-2019-8322", "CVE-2019-8323", "CVE-2019-8324", "CVE-2019-8325");
    
      script_name(english:"SUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the
    following issues :
    
    Changes in ruby2.5 :
    
    Update to 2.5.5 and 2.5.4 :
    
    https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/
    https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/
    
    Security issues fixed :
    
    CVE-2019-8320: Delete directory using symlink when decompressing tar
    (bsc#1130627)
    
    CVE-2019-8321: Escape sequence injection vulnerability in verbose
    (bsc#1130623)
    
    CVE-2019-8322: Escape sequence injection vulnerability in gem owner
    (bsc#1130622)
    
    CVE-2019-8323: Escape sequence injection vulnerability in API response
    handling (bsc#1130620)
    
    CVE-2019-8324: Installing a malicious gem may lead to arbitrary code
    execution (bsc#1130617)
    
    CVE-2019-8325: Escape sequence injection vulnerability in errors
    (bsc#1130611)
    
    Ruby 2.5 was updated to 2.5.3 :
    
    This release includes some bug fixes and some security fixes.
    
    Security issues fixed: CVE-2018-16396: Tainted flags are not
    propagated in Array#pack and String#unpack with some directives
    (bsc#1112532)
    
    CVE-2018-16395: OpenSSL::X509::Name equality check does not work
    correctly (bsc#1112530)
    
    Ruby 2.5 was updated to 2.5.1 :
    
    This release includes some bug fixes and some security fixes.
    
    Security issues fixed: CVE-2017-17742: HTTP response splitting in
    WEBrick (bsc#1087434)
    
    CVE-2018-6914: Unintentional file and directory creation with
    directory traversal in tempfile and tmpdir (bsc#1087441)
    
    CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)
    
    CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)
    
    CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
    UNIXServer and UNIXSocket (bsc#1087440)
    
    CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
    in Dir (bsc#1087437)
    
    Multiple vulnerabilities in RubyGems were fixed :
    
      - CVE-2018-1000079: Fixed path traversal issue during gem
        installation allows to write to arbitrary filesystem
        locations (bsc#1082058)
    
      - CVE-2018-1000075: Fixed infinite loop vulnerability due
        to negative size in tar header causes Denial of Service
        (bsc#1082014)
    
      - CVE-2018-1000078: Fixed XSS vulnerability in homepage
        attribute when displayed via gem server (bsc#1082011)
    
      - CVE-2018-1000077: Fixed that missing URL validation on
        spec home attribute allows malicious gem to set an
        invalid homepage URL (bsc#1082010)
    
      - CVE-2018-1000076: Fixed improper verification of
        signatures in tarball allows to install mis-signed gem
        (bsc#1082009)
    
      - CVE-2018-1000074: Fixed unsafe Object Deserialization
        Vulnerability in gem owner allowing arbitrary code
        execution on specially crafted YAML (bsc#1082008)
    
      - CVE-2018-1000073: Fixed path traversal when writing to a
        symlinked basedir outside of the root (bsc#1082007)
    
    Other changes: Fixed Net::POPMail methods modify frozen literal when
    using default arg
    
    ruby: change over of the Japanese Era to the new emperor May 1st 2019
    (bsc#1133790)
    
    build with PIE support (bsc#1130028)
    
    Changes in ruby-bundled-gems-rpmhelper: Add a new helper for bundled
    ruby gems.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082007"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082008"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082009"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082010"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082011"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082014"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1082058"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1087433"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1087434"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1087436"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1087437"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1087440"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1087441"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1112530"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1112532"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130028"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130611"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130617"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130620"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130622"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130623"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1130627"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1133790"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-17742/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000073/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000074/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000075/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000076/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000077/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000078/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-1000079/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16395/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16396/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-6914/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-8777/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-8778/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-8779/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-8780/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-8320/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-8321/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-8322/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-8323/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-8324/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-8325/"
      );
      # https://www.suse.com/support/update/announcement/2019/suse-su-20191804-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f388fbfb"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Module for Open Buildservice Development Tools
    15-SP1:zypper in -t patch
    SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1804=1
    
    SUSE Linux Enterprise Module for Open Buildservice Development Tools
    15:zypper in -t patch
    SUSE-SLE-Module-Development-Tools-OBS-15-2019-1804=1
    
    SUSE Linux Enterprise Module for Basesystem 15-SP1:zypper in -t patch
    SUSE-SLE-Module-Basesystem-15-SP1-2019-1804=1
    
    SUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch
    SUSE-SLE-Module-Basesystem-15-2019-1804=1"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-8320");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libruby2_5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libruby2_5-2_5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-devel-extra");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-stdlib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ruby2.5-stdlib-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/07/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/11");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED15|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES15" && (! preg(pattern:"^(0|1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0/1", os_ver + " SP" + sp);
    if (os_ver == "SLED15" && (! preg(pattern:"^(0|1)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP0/1", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-doc-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"libruby2_5-2_5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"libruby2_5-2_5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-devel-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-devel-extra-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-stdlib-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"ruby2.5-stdlib-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-doc-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libruby2_5-2_5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libruby2_5-2_5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-devel-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-devel-extra-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-stdlib-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"ruby2.5-stdlib-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-doc-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"libruby2_5-2_5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"libruby2_5-2_5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-devel-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-devel-extra-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-stdlib-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"ruby2.5-stdlib-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-doc-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libruby2_5-2_5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libruby2_5-2_5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-debuginfo-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-debugsource-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-devel-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-devel-extra-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-stdlib-2.5.5-4.3.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"ruby2.5-stdlib-debuginfo-2.5.5-4.3.1")) flag++;
    
    
    if (flag)
    {
      set_kb_item(name:'www/0/XSS', value:TRUE);
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby-bundled-gems-rpmhelper / ruby2.5");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0542.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-19
    plugin id133785
    published2020-02-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133785
    titleRHEL 7 : ruby (RHSA-2020:0542)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2020:0542. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133785);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24");
    
      script_cve_id("CVE-2018-1000073", "CVE-2018-1000074", "CVE-2018-1000075", "CVE-2018-1000076", "CVE-2018-1000077", "CVE-2018-1000078", "CVE-2018-1000079", "CVE-2018-8777", "CVE-2018-8780");
      script_xref(name:"RHSA", value:"2020:0542");
    
      script_name(english:"RHEL 7 : ruby (RHSA-2020:0542)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for ruby is now available for Red Hat Enterprise Linux 7.5
    Extended Update Support.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Ruby is an extensible, interpreted, object-oriented, scripting
    language. It has features to process text files and to perform system
    management tasks.
    
    Security Fix(es) :
    
    * ruby: DoS by large request in WEBrick (CVE-2018-8777)
    
    * ruby: Unintentional directory traversal by poisoned NULL byte in Dir
    (CVE-2018-8780)
    
    * rubygems: Path traversal when writing to a symlinked basedir outside
    of the root (CVE-2018-1000073)
    
    * rubygems: Unsafe Object Deserialization Vulnerability in gem owner
    allowing arbitrary code execution on specially crafted YAML
    (CVE-2018-1000074)
    
    * rubygems: Improper verification of signatures in tarball allows to
    install mis-signed gem (CVE-2018-1000076)
    
    * rubygems: Missing URL validation on spec home attribute allows
    malicious gem to set an invalid homepage URL (CVE-2018-1000077)
    
    * rubygems: XSS vulnerability in homepage attribute when displayed via
    gem server (CVE-2018-1000078)
    
    * rubygems: Path traversal issue during gem installation allows to
    write to arbitrary filesystem locations (CVE-2018-1000079)
    
    * rubygems: Infinite loop vulnerability due to negative size in tar
    header causes Denial of Service (CVE-2018-1000075)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2020:0542"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8777"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8780"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000073"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000074"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000075"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000076"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000077"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000078"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000079"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8780");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-tcltk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-json");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-minitest");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rake");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rdoc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/19");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7\.5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.5", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2020:0542";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"ruby-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"ruby-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"ruby-debuginfo-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"ruby-devel-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"ruby-devel-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"ruby-doc-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"ruby-irb-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"ruby-libs-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"ruby-tcltk-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"ruby-tcltk-2.0.0.648-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"rubygem-bigdecimal-1.2.0-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"rubygem-bigdecimal-1.2.0-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"rubygem-io-console-0.4.2-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"rubygem-io-console-0.4.2-35.el7_5")) flag++;
      if (rpm_exists(rpm:"rubygem-json-1.7", release:"RHEL7") && rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"rubygem-json-1.7.7-35.el7_5")) flag++;
      if (rpm_exists(rpm:"rubygem-json-1.7", release:"RHEL7") && rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"rubygem-json-1.7.7-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"rubygem-minitest-4.3.2-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"s390x", reference:"rubygem-psych-2.0.0-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", cpu:"x86_64", reference:"rubygem-psych-2.0.0-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"rubygem-rake-0.9.6-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"rubygem-rdoc-4.0.0-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"rubygems-2.0.14.1-35.el7_5")) flag++;
      if (rpm_check(release:"RHEL7", sp:"5", reference:"rubygems-devel-2.0.14.1-35.el7_5")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby / ruby-debuginfo / ruby-devel / ruby-doc / ruby-irb / etc");
      }
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_EB69BCF218EF4AA2BB0C83B263364089.NASL
    descriptionRuby news : CVE-2017-17742: HTTP response splitting in WEBrick If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients. CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir Dir.mktmpdir method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. The prefix can contain relative directory specifiers
    last seen2020-06-01
    modified2020-06-02
    plugin id108739
    published2018-03-30
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108739
    titleFreeBSD : ruby -- multiple vulnerabilities (eb69bcf2-18ef-4aa2-bb0c-83b263364089)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2019 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(108739);
      script_version("1.6");
      script_cvs_date("Date: 2019/07/10 16:04:13");
    
      script_cve_id("CVE-2017-17742", "CVE-2018-6914", "CVE-2018-8777", "CVE-2018-8778", "CVE-2018-8779", "CVE-2018-8780");
    
      script_name(english:"FreeBSD : ruby -- multiple vulnerabilities (eb69bcf2-18ef-4aa2-bb0c-83b263364089)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Ruby news :
    
    CVE-2017-17742: HTTP response splitting in WEBrick
    
    If a script accepts an external input and outputs it without
    modification as a part of HTTP responses, an attacker can use newline
    characters to deceive the clients that the HTTP response header is
    stopped at there, and can inject fake HTTP responses after the newline
    characters to show malicious contents to the clients.
    
    CVE-2018-6914: Unintentional file and directory creation with
    directory traversal in tempfile and tmpdir
    
    Dir.mktmpdir method introduced by tmpdir library accepts the prefix
    and the suffix of the directory which is created as the first
    parameter. The prefix can contain relative directory specifiers '../',
    so this method can be used to target any directory. So, if a script
    accepts an external input as the prefix, and the targeted directory
    has inappropriate permissions or the ruby process has inappropriate
    privileges, the attacker can create a directory or a file at any
    directory.
    
    CVE-2018-8777: DoS by large request in WEBrick
    
    If an attacker sends a large request which contains huge HTTP headers,
    WEBrick try to process it on memory, so the request causes the
    out-of-memory DoS attack.
    
    CVE-2018-8778: Buffer under-read in String#unpack
    
    String#unpack receives format specifiers as its parameter, and can be
    specified the position of parsing the data by the specifier @. If a
    big number is passed with @, the number is treated as the negative
    value, and out-of-buffer read is occurred. So, if a script accepts an
    external input as the argument of String#unpack, the attacker can read
    data on heaps.
    
    CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
    UNIXServer and UNIXSocket
    
    UNIXServer.open accepts the path of the socket to be created at the
    first parameter. If the path contains NUL (\0) bytes, this method
    recognize that the path is completed before the NUL bytes. So, if a
    script accepts an external input as the argument of this method, the
    attacker can make the socket file in the unintentional path. And,
    UNIXSocket.open also accepts the path of the socket to be created at
    the first parameter without checking NUL bytes like UNIXServer.open.
    So, if a script accepts an external input as the argument of this
    method, the attacker can accepts the socket file in the unintentional
    path.
    
    CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
    in Dir
    
    Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
    target directory as their parameter. If the parameter contains NUL
    (\0) bytes, these methods recognize that the path is completed before
    the NUL bytes. So, if a script accepts an external input as the
    argument of these methods, the attacker can make the unintentional
    directory traversal."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/"
      );
      # https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?71079310"
      );
      # https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?78bd7fa9"
      );
      # https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?e4a4feab"
      );
      # https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?1b770e41"
      );
      # https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?95c4af25"
      );
      # https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?23857932"
      );
      # https://vuxml.freebsd.org/freebsd/eb69bcf2-18ef-4aa2-bb0c-83b263364089.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4e3e020f"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ruby");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/03/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"ruby>=2.3.0,1<2.3.7,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ruby>=2.4.0,1<2.4.4,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ruby>=2.5.0,1<2.5.1,1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1206.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application
    last seen2020-05-06
    modified2018-07-03
    plugin id110870
    published2018-07-03
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110870
    titleEulerOS 2.0 SP2 : ruby (EulerOS-SA-2018-1206)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110870);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");
    
      script_cve_id(
        "CVE-2018-6914",
        "CVE-2018-8777",
        "CVE-2018-8778",
        "CVE-2018-8779",
        "CVE-2018-8780"
      );
    
      script_name(english:"EulerOS 2.0 SP2 : ruby (EulerOS-SA-2018-1206)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the ruby packages installed, the EulerOS
    installation on the remote host is affected by the following
    vulnerabilities :
    
      - It was found that the tmpdir and tempfile modules did
        not sanitize their file name argument. An attacker with
        control over the name could create temporary files and
        directories outside of the dedicated
        directory.(CVE-2018-6914)
    
      - A integer underflow was found in the way String#unpack
        decodes the unpacking format. An attacker, able to
        control the unpack format, could use this flaw to
        disclose arbitrary parts of the application's
        memory.(CVE-2018-8778)
    
      - It was found that the UNIXSocket::open and
        UNIXServer::open ruby methods did not handle the NULL
        byte properly. An attacker, able to inject NULL bytes
        in the socket path, could possibly trigger an
        unspecified behavior of the ruby script.(CVE-2018-8779)
    
      - It was found that the methods from the Dir class did
        not properly handle strings containing the NULL byte.
        An attacker, able to inject NULL bytes in a path, could
        possibly trigger an unspecified behavior of the ruby
        script.(CVE-2018-8780)
    
      - It was found that WEBrick could be forced to use an
        excessive amount of memory during the processing of
        HTTP requests, leading to a Denial of Service. An
        attacker could use this flaw to send huge requests to a
        WEBrick application, resulting in the server running
        out of memory.(CVE-2018-8777)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1206
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4347e6a6");
      script_set_attribute(attribute:"solution", value:
    "Update the affected ruby packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/06/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/03");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-libs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["ruby-2.0.0.648-33.h11",
            "ruby-irb-2.0.0.648-33.h11",
            "ruby-libs-2.0.0.648-33.h11"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1358.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7
    last seen2020-03-17
    modified2018-04-24
    plugin id109283
    published2018-04-24
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109283
    titleDebian DLA-1358-1 : ruby1.9.1 security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1358-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109283);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2017-17742", "CVE-2018-1000075", "CVE-2018-1000076", "CVE-2018-1000077", "CVE-2018-1000078", "CVE-2018-6914", "CVE-2018-8777", "CVE-2018-8778", "CVE-2018-8779", "CVE-2018-8780");
    
      script_name(english:"Debian DLA-1358-1 : ruby1.9.1 security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities were found in the interpreter for the Ruby
    language. The Common Vulnerabilities and Exposures project identifies
    the following issues :
    
    CVE-2017-17742
    
    Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable
    to an HTTP response splitting vulnerability. It was possible for an
    attacker to inject fake HTTP responses if a script accepted an
    external input and output it without modifications.
    
    CVE-2018-6914
    
    ooooooo_q discovered a directory traversal vulnerability in the
    Dir.mktmpdir method in the tmpdir library. It made it possible for
    attackers to create arbitrary directories or files via a .. (dot dot)
    in the prefix argument.
    
    CVE-2018-8777
    
    Eric Wong reported an out-of-memory DoS vulnerability related to a
    large request in WEBrick bundled with Ruby.
    
    CVE-2018-8778
    
    aerodudrizzt found a buffer under-read vulnerability in the Ruby
    String#unpack method. If a big number was passed with the specifier @,
    the number was treated as a negative value, and an out-of-buffer read
    occurred. Attackers could read data on heaps if an script accepts an
    external input as the argument of String#unpack.
    
    CVE-2018-8779
    
    ooooooo_q reported that the UNIXServer.open and UNIXSocket.open
    methods of the socket library bundled with Ruby did not check for NUL
    bytes in the path argument. The lack of check made the methods
    vulnerable to unintentional socket creation and unintentional socket
    access.
    
    CVE-2018-8780
    
    ooooooo_q discovered an unintentional directory traversal in some
    methods in Dir, by the lack of checking for NUL bytes in their
    parameter.
    
    CVE-2018-1000075
    
    A negative size vulnerability in ruby gem package tar header that
    could cause an infinite loop.
    
    CVE-2018-1000076
    
    Ruby gems package improperly verifies cryptographic signatures. A
    mis-signed gem could be installed if the tarball contains multiple gem
    signatures.
    
    CVE-2018-1000077
    
    An improper input validation vulnerability in ruby gems specification
    homepage attribute could allow malicious gem to set an invalid
    homepage URL.
    
    CVE-2018-1000078
    
    Cross Site Scripting (XSS) vulnerability in gem server display of
    homepage attribute
    
    For Debian 7 'Wheezy', these problems have been fixed in version
    1.9.3.194-8.1+deb7u8.
    
    We recommend that you upgrade your ruby1.9.1 packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/ruby1.9.1"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libruby1.9.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libruby1.9.1-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libtcltk-ruby1.9.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ri1.9.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby1.9.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby1.9.1-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby1.9.1-examples");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby1.9.1-full");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby1.9.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/04/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"libruby1.9.1", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"libruby1.9.1-dbg", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"libtcltk-ruby1.9.1", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"ri1.9.1", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"ruby1.9.1", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"ruby1.9.1-dev", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"ruby1.9.1-examples", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"ruby1.9.1-full", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    if (deb_check(release:"7.0", prefix:"ruby1.9.3", reference:"1.9.3.194-8.1+deb7u8")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2028.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id127649
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127649
    titleRHEL 7 : ruby (RHSA-2019:2028)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2019:2028. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(127649);
      script_version("1.5");
      script_cvs_date("Date: 2020/01/06");
    
      script_cve_id("CVE-2017-17742", "CVE-2018-1000073", "CVE-2018-1000074", "CVE-2018-1000075", "CVE-2018-1000076", "CVE-2018-1000077", "CVE-2018-1000078", "CVE-2018-1000079", "CVE-2018-16396", "CVE-2018-6914", "CVE-2018-8777", "CVE-2018-8778", "CVE-2018-8779", "CVE-2018-8780");
      script_xref(name:"RHSA", value:"2019:2028");
    
      script_name(english:"RHEL 7 : ruby (RHSA-2019:2028)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for ruby is now available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Ruby is an extensible, interpreted, object-oriented, scripting
    language. It has features to process text files and to perform system
    management tasks.
    
    Security Fix(es) :
    
    * ruby: HTTP response splitting in WEBrick (CVE-2017-17742)
    
    * ruby: DoS by large request in WEBrick (CVE-2018-8777)
    
    * ruby: Buffer under-read in String#unpack (CVE-2018-8778)
    
    * ruby: Unintentional directory traversal by poisoned NULL byte in Dir
    (CVE-2018-8780)
    
    * ruby: Tainted flags are not propagated in Array#pack and
    String#unpack with some directives (CVE-2018-16396)
    
    * rubygems: Path traversal when writing to a symlinked basedir outside
    of the root (CVE-2018-1000073)
    
    * rubygems: Unsafe Object Deserialization Vulnerability in gem owner
    allowing arbitrary code execution on specially crafted YAML
    (CVE-2018-1000074)
    
    * rubygems: Improper verification of signatures in tarball allows to
    install mis-signed gem (CVE-2018-1000076)
    
    * rubygems: Missing URL validation on spec home attribute allows
    malicious gem to set an invalid homepage URL (CVE-2018-1000077)
    
    * rubygems: XSS vulnerability in homepage attribute when displayed via
    gem server (CVE-2018-1000078)
    
    * rubygems: Path traversal issue during gem installation allows to
    write to arbitrary filesystem locations (CVE-2018-1000079)
    
    * ruby: Unintentional file and directory creation with directory
    traversal in tempfile and tmpdir (CVE-2018-6914)
    
    * ruby: Unintentional socket creation by poisoned NULL byte in
    UNIXServer and UNIXSocket (CVE-2018-8779)
    
    * rubygems: Infinite loop vulnerability due to negative size in tar
    header causes Denial of Service (CVE-2018-1000075)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section.
    
    Additional Changes :
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 7.7 Release Notes linked from the References section."
      );
      # https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?3395ff0b"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2019:2028"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-17742"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-6914"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8777"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8778"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8779"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8780"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-16396"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000073"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000074"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000075"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000076"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000077"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000078"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000079"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8780");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-tcltk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-json");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-minitest");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rake");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rdoc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/08/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2019:2028";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"ruby-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ruby-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"ruby-debuginfo-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"ruby-devel-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ruby-devel-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"ruby-doc-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"ruby-irb-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"ruby-libs-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"ruby-tcltk-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ruby-tcltk-2.0.0.648-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-bigdecimal-1.2.0-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-bigdecimal-1.2.0-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-io-console-0.4.2-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-io-console-0.4.2-36.el7")) flag++;
      if (rpm_exists(rpm:"rubygem-json-1.7", release:"RHEL7") && rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-json-1.7.7-36.el7")) flag++;
      if (rpm_exists(rpm:"rubygem-json-1.7", release:"RHEL7") && rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-json-1.7.7-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"rubygem-minitest-4.3.2-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-psych-2.0.0-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-psych-2.0.0-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"rubygem-rake-0.9.6-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"rubygem-rdoc-4.0.0-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"rubygems-2.0.14.1-36.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"rubygems-devel-2.0.14.1-36.el7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby / ruby-debuginfo / ruby-devel / ruby-doc / ruby-irb / etc");
      }
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2018-983.NASL
    descriptionPath traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) Improper verification of signatures in tarball allows to install mis-signed gem : RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) Infinite loop vulnerability due to negative size in tar header causes Denial of Service RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution : The
    last seen2020-06-01
    modified2020-06-02
    plugin id108846
    published2018-04-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108846
    titleAmazon Linux AMI : ruby20 / ruby22,ruby23,ruby24 (ALAS-2018-983)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2018-983.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(108846);
      script_version("1.4");
      script_cvs_date("Date: 2019/07/10 16:04:12");
    
      script_cve_id("CVE-2017-17742", "CVE-2017-17790", "CVE-2018-1000073", "CVE-2018-1000074", "CVE-2018-1000075", "CVE-2018-1000076", "CVE-2018-1000077", "CVE-2018-1000078", "CVE-2018-1000079", "CVE-2018-6914", "CVE-2018-8777", "CVE-2018-8778", "CVE-2018-8779", "CVE-2018-8780");
      script_xref(name:"ALAS", value:"2018-983");
    
      script_name(english:"Amazon Linux AMI : ruby20 / ruby22,ruby23,ruby24 (ALAS-2018-983)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Path traversal when writing to a symlinked basedir outside of the root
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    Directory Traversal vulnerability in install_location function of
    package.rb that can result in path traversal when writing to a
    symlinked basedir outside of the root. This vulnerability appears to
    have been fixed in 2.7.6. (CVE-2018-1000073)
    
    Improper verification of signatures in tarball allows to install
    mis-signed gem :
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    Improper Verification of Cryptographic Signature vulnerability in
    package.rb that can result in a mis-signed gem could be installed, as
    the tarball would contain multiple gem signatures.. This vulnerability
    appears to have been fixed in 2.7.6. (CVE-2018-1000076)
    
    Infinite loop vulnerability due to negative size in tar header causes
    Denial of Service
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    infinite loop caused by negative size vulnerability in ruby gem
    package tar header that can result in a negative size could cause an
    infinite loop.. This vulnerability appears to have been fixed in
    2.7.6. (CVE-2018-1000075)
    
    Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary
    code execution :
    
    The 'lazy_initialize' function in lib/resolv.rb did not properly
    process certain filenames. A remote attacker could possibly exploit
    this flaw to inject and execute arbitrary commands. (CVE-2017-17790)
    
    Missing URL validation on spec home attribute allows malicious gem to
    set an invalid homepage URL :
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    Improper Input Validation vulnerability in ruby gems specification
    homepage attribute that can result in a malicious gem could set an
    invalid homepage URL. This vulnerability appears to have been fixed in
    2.7.6. (CVE-2018-1000077)
    
    XSS vulnerability in homepage attribute when displayed via gem server
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    Cross Site Scripting (XSS) vulnerability in gem server display of
    homepage attribute that can result in XSS. This attack appear to be
    exploitable via the victim must browse to a malicious gem on a
    vulnerable gem server. This vulnerability appears to have been fixed
    in 2.7.6. (CVE-2018-1000078)
    
    Unsafe Object Deserialization Vulnerability in gem owner allowing
    arbitrary code execution on specially crafted YAML
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    Deserialization of Untrusted Data vulnerability in owner command that
    can result in code execution. This attack appear to be exploitable via
    victim must run the `gem owner` command on a gem with a specially
    crafted YAML file. This vulnerability appears to have been fixed in
    2.7.6. (CVE-2018-1000074)
    
    Path traversal issue during gem installation allows to write to
    arbitrary filesystem locations
    
    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series:
    2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5
    series: 2.5.0 and earlier, prior to trunk revision 62422 contains a
    Directory Traversal vulnerability in gem installation that can result
    in the gem could write to arbitrary filesystem locations during
    installation. This attack appear to be exploitable via the victim must
    install a malicious gem. This vulnerability appears to have been fixed
    in 2.7.6. (CVE-2018-1000079)
    
    If a script accepts an external input and outputs it without
    modification as a part of HTTP responses, an attacker can use newline
    characters to deceive the clients that the HTTP response header is
    stopped at there, and can inject fake HTTP responses after the newline
    characters to show malicious contents to the clients.(CVE-2017-17742)
    
    The Dir.mktmpdir method introduced by tmpdir library accepts the
    prefix and the suffix of the directory which is created as the first
    parameter. The prefix can contain relative directory specifiers '../',
    so this method can be used to target any directory. So, if a script
    accepts an external input as the prefix, and the targeted directory
    has inappropriate permissions or the ruby process has inappropriate
    privileges, the attacker can create a directory or a file at any
    directory.(CVE-2018-6914)
    
    If an attacker sends a large request which contains huge HTTP headers,
    WEBrick try to process it on memory, so the request causes the
    out-of-memory DoS attack.(CVE-2018-8777)
    
    String#unpack receives format specifiers as its parameter, and can be
    specified the position of parsing the data by the specifier @. If a
    big number is passed with @, the number is treated as the negative
    value, and out-of-buffer read is occurred. So, if a script accepts an
    external input as the argument of String#unpack, the attacker can read
    data on heaps.(CVE-2018-8778)
    
    UNIXServer.open accepts the path of the socket to be created at the
    first parameter. If the path contains NUL (\0) bytes, this method
    recognize that the path is completed before the NUL bytes. So, if a
    script accepts an external input as the argument of this method, the
    attacker can make the socket file in the unintentional path. And,
    UNIXSocket.open also accepts the path of the socket to be created at
    the first parameter without checking NUL bytes like UNIXServer.open.
    So, if a script accepts an external input as the argument of this
    method, the attacker can accepts the socket file in the unintentional
    path.(CVE-2018-8779)
    
    Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
    target directory as their parameter. If the parameter contains NUL
    (\0) bytes, these methods recognize that the path is completed before
    the NUL bytes. So, if a script accepts an external input as the
    argument of these methods, the attacker can make the unintentional
    directory traversal.(CVE-2018-8780)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2018-983.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Run 'yum update ruby20' to update your system.
    
    Run 'yum update ruby22' to update your system.
    
    Run 'yum update ruby23' to update your system.
    
    Run 'yum update ruby24' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby20");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby20-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby20-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby20-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby20-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby20-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby22");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby22-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby22-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby22-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby22-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby22-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby23");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby23-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby23-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby23-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby23-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby23-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby24");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby24-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby24-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby24-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby24-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:ruby24-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem20-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem20-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem20-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem22-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem22-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem22-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem23-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem23-did_you_mean");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem23-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem23-json");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem23-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem24-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem24-did_you_mean");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem24-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem24-json");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem24-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygem24-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems20");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems20-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems22");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems22-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems23");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems23-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems24");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rubygems24-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/12/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"ruby20-2.0.0.648-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby20-debuginfo-2.0.0.648-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby20-devel-2.0.0.648-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby20-doc-2.0.0.648-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby20-irb-2.0.0.648-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby20-libs-2.0.0.648-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby22-2.2.10-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby22-debuginfo-2.2.10-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby22-devel-2.2.10-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby22-doc-2.2.10-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby22-irb-2.2.10-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby22-libs-2.2.10-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby23-2.3.7-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby23-debuginfo-2.3.7-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby23-devel-2.3.7-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby23-doc-2.3.7-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby23-irb-2.3.7-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby23-libs-2.3.7-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby24-2.4.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby24-debuginfo-2.4.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby24-devel-2.4.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby24-doc-2.4.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby24-irb-2.4.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"ruby24-libs-2.4.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem20-bigdecimal-1.2.0-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem20-io-console-0.4.2-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem20-psych-2.0.0-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem22-bigdecimal-1.2.6-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem22-io-console-0.4.3-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem22-psych-2.0.8.1-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem23-bigdecimal-1.2.8-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem23-did_you_mean-1.0.0-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem23-io-console-0.4.5-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem23-json-1.8.3.1-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem23-psych-2.1.0.1-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem24-bigdecimal-1.3.2-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem24-did_you_mean-1.1.0-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem24-io-console-0.4.6-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem24-json-2.0.4-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem24-psych-2.2.2-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygem24-xmlrpc-0.2.1-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems20-2.0.14.1-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems20-devel-2.0.14.1-1.31.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems22-2.4.5.2-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems22-devel-2.4.5.2-1.11.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems23-2.5.2.3-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems23-devel-2.5.2.3-1.19.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems24-2.6.14.1-1.30.6.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"rubygems24-devel-2.6.14.1-1.30.6.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby20 / ruby20-debuginfo / ruby20-devel / ruby20-doc / ruby20-irb / etc");
    }
    
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0245_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ruby packages installed that are affected by multiple vulnerabilities: - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. (CVE-2018-8778) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780) - Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. (CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. (CVE-2018-16396) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. (CVE-2018-8779) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id132492
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132492
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : ruby Multiple Vulnerabilities (NS-SA-2019-0245)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0245. The text
    # itself is copyright (C) ZTE, Inc.
    
    include('compat.inc');
    
    if (description)
    {
      script_id(132492);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id(
        "CVE-2017-17742",
        "CVE-2018-6914",
        "CVE-2018-8777",
        "CVE-2018-8778",
        "CVE-2018-8779",
        "CVE-2018-8780",
        "CVE-2018-16396",
        "CVE-2018-1000073",
        "CVE-2018-1000074",
        "CVE-2018-1000075",
        "CVE-2018-1000076",
        "CVE-2018-1000077",
        "CVE-2018-1000078",
        "CVE-2018-1000079"
      );
      script_bugtraq_id(
        103683,
        103684,
        103686,
        103693,
        103739,
        103767,
        105955
      );
    
      script_name(english:"NewStart CGSL CORE 5.05 / MAIN 5.05 : ruby Multiple Vulnerabilities (NS-SA-2019-0245)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ruby packages installed that are affected by
    multiple vulnerabilities:
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
        attacker controlling the unpacking format (similar to
        format string vulnerabilities) can trigger a buffer
        under-read in the String#unpack method, resulting in a
        massive and controlled information disclosure.
        (CVE-2018-8778)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Directory
        Traversal vulnerability in install_location function of
        package.rb that can result in path traversal when
        writing to a symlinked basedir outside of the root. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000073)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
        Dir.open, Dir.new, Dir.entries and Dir.empty? methods do
        not check NULL characters. When using the corresponding
        method, unintentional directory traversal may be
        performed. (CVE-2018-8780)
    
      - Directory traversal vulnerability in the Dir.mktmpdir
        method in the tmpdir library in Ruby before 2.2.10,
        2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before
        2.5.1, and 2.6.0-preview1 might allow attackers to
        create arbitrary directories or files via a .. (dot dot)
        in the prefix argument. (CVE-2018-6914)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an
        attacker can pass a large HTTP request with a crafted
        header to WEBrick server or a crafted body to WEBrick
        server/handler and cause a denial of service (memory
        consumption). (CVE-2018-8777)
    
      - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an
        HTTP Response Splitting attack. An attacker can inject a
        crafted key and value into an HTTP response for the HTTP
        server of WEBrick. (CVE-2017-17742)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Deserialization
        of Untrusted Data vulnerability in owner command that
        can result in code execution. This attack appear to be
        exploitable via victim must run the `gem owner` command
        on a gem with a specially crafted YAML file. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000074)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Cross Site
        Scripting (XSS) vulnerability in gem server display of
        homepage attribute that can result in XSS. This attack
        appear to be exploitable via the victim must browse to a
        malicious gem on a vulnerable gem server. This
        vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000078)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Directory
        Traversal vulnerability in gem installation that can
        result in the gem could write to arbitrary filesystem
        locations during installation. This attack appear to be
        exploitable via the victim must install a malicious gem.
        This vulnerability appears to have been fixed in 2.7.6.
        (CVE-2018-1000079)
    
      - An issue was discovered in Ruby before 2.3.8, 2.4.x
        before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before
        2.6.0-preview3. It does not taint strings that result
        from unpacking tainted strings with some formats.
        (CVE-2018-16396)
    
      - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before
        2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the
        UNIXServer.open and UNIXSocket.open methods are not
        checked for null characters. It may be connected to an
        unintended socket. (CVE-2018-8779)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a infinite loop
        caused by negative size vulnerability in ruby gem
        package tar header that can result in a negative size
        could cause an infinite loop.. This vulnerability
        appears to have been fixed in 2.7.6. (CVE-2018-1000075)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Improper
        Verification of Cryptographic Signature vulnerability in
        package.rb that can result in a mis-signed gem could be
        installed, as the tarball would contain multiple gem
        signatures.. This vulnerability appears to have been
        fixed in 2.7.6. (CVE-2018-1000076)
    
      - RubyGems version Ruby 2.2 series: 2.2.9 and earlier,
        Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series:
        2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier,
        prior to trunk revision 62422 contains a Improper Input
        Validation vulnerability in ruby gems specification
        homepage attribute that can result in a malicious gem
        could set an invalid homepage URL. This vulnerability
        appears to have been fixed in 2.7.6. (CVE-2018-1000077)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0245");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL ruby packages. Note that updated packages may not be available yet. Please contact ZTE for
    more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8780");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/31");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.05" &&
        release !~ "CGSL MAIN 5.05")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.05 / NewStart CGSL MAIN 5.05');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.05": [
        "ruby-2.0.0.648-36.el7",
        "ruby-debuginfo-2.0.0.648-36.el7",
        "ruby-devel-2.0.0.648-36.el7",
        "ruby-doc-2.0.0.648-36.el7",
        "ruby-irb-2.0.0.648-36.el7",
        "ruby-libs-2.0.0.648-36.el7",
        "ruby-tcltk-2.0.0.648-36.el7",
        "rubygem-bigdecimal-1.2.0-36.el7",
        "rubygem-io-console-0.4.2-36.el7",
        "rubygem-json-1.7.7-36.el7",
        "rubygem-minitest-4.3.2-36.el7",
        "rubygem-psych-2.0.0-36.el7",
        "rubygem-rake-0.9.6-36.el7",
        "rubygem-rdoc-4.0.0-36.el7",
        "rubygems-2.0.14.1-36.el7",
        "rubygems-devel-2.0.14.1-36.el7"
      ],
      "CGSL MAIN 5.05": [
        "ruby-2.0.0.648-36.el7",
        "ruby-debuginfo-2.0.0.648-36.el7",
        "ruby-devel-2.0.0.648-36.el7",
        "ruby-doc-2.0.0.648-36.el7",
        "ruby-irb-2.0.0.648-36.el7",
        "ruby-libs-2.0.0.648-36.el7",
        "ruby-tcltk-2.0.0.648-36.el7",
        "rubygem-bigdecimal-1.2.0-36.el7",
        "rubygem-io-console-0.4.2-36.el7",
        "rubygem-json-1.7.7-36.el7",
        "rubygem-minitest-4.3.2-36.el7",
        "rubygem-psych-2.0.0-36.el7",
        "rubygem-rake-0.9.6-36.el7",
        "rubygem-rdoc-4.0.0-36.el7",
        "rubygems-2.0.14.1-36.el7",
        "rubygems-devel-2.0.14.1-36.el7"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1275.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application
    last seen2020-06-01
    modified2020-06-02
    plugin id117584
    published2018-09-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117584
    titleEulerOS Virtualization 2.5.1 : ruby (EulerOS-SA-2018-1275)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1207.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application
    last seen2020-05-31
    modified2018-07-03
    plugin id110871
    published2018-07-03
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110871
    titleEulerOS 2.0 SP3 : ruby (EulerOS-SA-2018-1207)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0591.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-18
    modified2020-02-26
    plugin id134063
    published2020-02-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134063
    titleRHEL 7 : ruby (RHSA-2020:0591)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1276.NASL
    descriptionIt was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory. (CVE-2018-8777) It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory. (CVE-2018-6914) It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server
    last seen2020-06-01
    modified2020-06-02
    plugin id128290
    published2019-08-28
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128290
    titleAmazon Linux 2 : ruby (ALAS-2019-1276)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190806_RUBY_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - ruby: HTTP response splitting in WEBrick (CVE-2017-17742) - ruby: DoS by large request in WEBrick (CVE-2018-8777) - ruby: Buffer under-read in String#unpack (CVE-2018-8778) - ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) - ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) - rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) - rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) - rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) - rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) - rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) - rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) - ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) - ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) - rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075)
    last seen2020-03-18
    modified2019-08-27
    plugin id128260
    published2019-08-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128260
    titleScientific Linux Security Update : ruby on SL7.x x86_64 (20190806)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2018-004.NASL
    descriptionThe remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id111136
    published2018-07-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111136
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1421.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-9096 SMTP command injection in Net::SMTP via CRLF sequences in a RCPT TO or MAIL FROM command. CVE-2016-2339 Exploitable heap overflow in Fiddle::Function.new. CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf. CVE-2017-0899 ANSI escape sequence vulnerability in RubyGems. CVE-2017-0900 DoS vulnerability in the RubyGems query command. CVE-2017-0901 gem installer allowed a malicious gem to overwrite arbitrary files. CVE-2017-0902 RubyGems DNS request hijacking vulnerability. CVE-2017-0903 Max Justicz reported that RubyGems is prone to an unsafe object deserialization vulnerability. When parsed by an application which processes gems, a specially crafted YAML formatted gem specification can lead to remote code execution. CVE-2017-10784 Yusuke Endoh discovered an escape sequence injection vulnerability in the Basic authentication of WEBrick. An attacker can take advantage of this flaw to inject malicious escape sequences to the WEBrick log and potentially execute control characters on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id111081
    published2018-07-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111081
    titleDebian DLA-1421-1 : ruby2.1 security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1359.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. For Debian 7
    last seen2020-03-17
    modified2018-04-24
    plugin id109284
    published2018-04-24
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109284
    titleDebian DLA-1359-1 : ruby1.8 security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2028.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id128332
    published2019-08-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128332
    titleCentOS 7 : ruby (CESA-2019:2028)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-DD8162C004.NASL
    description - Rebase to Ruby 2.5.1. - Several CVE fixes. - Conflict requirement needs to generate dependency. - Stop using --with-setjmp-type=setjmp on aarch64. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120846
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120846
    titleFedora 28 : ruby (2018-dd8162c004)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-A459ACD54B.NASL
    descriptionBackport `rubygem.macros` changes. Enables maintaners to build rubygems using same macros in all Fedoras. ---- Rebase to Ruby 2.4.4. Includes several CVE fixes. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-06-07
    plugin id110389
    published2018-06-07
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110389
    titleFedora 27 : ruby (2018-a459acd54b)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4259.NASL
    descriptionSeveral vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure. This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.
    last seen2020-06-01
    modified2020-06-02
    plugin id111468
    published2018-08-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111468
    titleDebian DSA-4259-1 : ruby2.3 - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1771.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes : - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper : - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id126904
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126904
    titleopenSUSE Security Update : ruby-bundled-gems-rpmhelper / ruby2.5 (openSUSE-2019-1771)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1347.NASL
    descriptionAccording to the version of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory.(CVE-2018-8777) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id118435
    published2018-10-26
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118435
    titleEulerOS Virtualization 2.5.0 : ruby (EulerOS-SA-2018-1347)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2018-088-01.NASL
    descriptionNew ruby packages are available for Slackware 14.2 and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id108725
    published2018-03-30
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108725
    titleSlackware 14.2 / current : ruby (SSA:2018-088-01)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_10_13_6.NASL
    descriptionThe remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id111137
    published2018-07-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111137
    titlemacOS 10.13.x < 10.13.6 Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2018-005.NASL
    descriptionThe remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - afpserver - AppleGraphicsControl - APR - ATS - CFNetwork - CoreAnimation - CoreCrypto - CoreFoundation - CUPS - Dictionary - dyld - Foundation - Heimdal - Hypervisor - ICU - Intel Graphics Driver - IOGraphics - IOHIDFamily - IOKit - IOUserEthernet - IPSec - Kernel - Login Window - mDNSOffloadUserClient - MediaRemote - Microcode - Perl - Ruby - Security - Spotlight - Symptom Framework - WiFi
    last seen2020-06-01
    modified2020-06-02
    plugin id118573
    published2018-10-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118573
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-005)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0663.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-03-19
    modified2020-03-06
    plugin id134261
    published2020-03-06
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134261
    titleRHEL 7 : ruby (RHSA-2020:0663)

Redhat

advisories
  • rhsa
    idRHSA-2018:3729
  • rhsa
    idRHSA-2018:3730
  • rhsa
    idRHSA-2018:3731
  • rhsa
    idRHSA-2019:2028
  • rhsa
    idRHSA-2020:0542
  • rhsa
    idRHSA-2020:0591
  • rhsa
    idRHSA-2020:0663
rpms
  • rh-ruby23-ruby-0:2.3.8-69.el6
  • rh-ruby23-ruby-0:2.3.8-69.el7
  • rh-ruby23-ruby-debuginfo-0:2.3.8-69.el6
  • rh-ruby23-ruby-debuginfo-0:2.3.8-69.el7
  • rh-ruby23-ruby-devel-0:2.3.8-69.el6
  • rh-ruby23-ruby-devel-0:2.3.8-69.el7
  • rh-ruby23-ruby-doc-0:2.3.8-69.el6
  • rh-ruby23-ruby-doc-0:2.3.8-69.el7
  • rh-ruby23-ruby-irb-0:2.3.8-69.el6
  • rh-ruby23-ruby-irb-0:2.3.8-69.el7
  • rh-ruby23-ruby-libs-0:2.3.8-69.el6
  • rh-ruby23-ruby-libs-0:2.3.8-69.el7
  • rh-ruby23-ruby-tcltk-0:2.3.8-69.el6
  • rh-ruby23-ruby-tcltk-0:2.3.8-69.el7
  • rh-ruby23-rubygem-bigdecimal-0:1.2.8-69.el6
  • rh-ruby23-rubygem-bigdecimal-0:1.2.8-69.el7
  • rh-ruby23-rubygem-did_you_mean-0:1.0.0-69.el6
  • rh-ruby23-rubygem-did_you_mean-0:1.0.0-69.el7
  • rh-ruby23-rubygem-io-console-0:0.4.5-69.el6
  • rh-ruby23-rubygem-io-console-0:0.4.5-69.el7
  • rh-ruby23-rubygem-json-0:1.8.3.1-69.el6
  • rh-ruby23-rubygem-json-0:1.8.3.1-69.el7
  • rh-ruby23-rubygem-minitest-0:5.8.5-69.el6
  • rh-ruby23-rubygem-minitest-0:5.8.5-69.el7
  • rh-ruby23-rubygem-net-telnet-0:0.1.1-69.el6
  • rh-ruby23-rubygem-net-telnet-0:0.1.1-69.el7
  • rh-ruby23-rubygem-power_assert-0:0.2.6-69.el6
  • rh-ruby23-rubygem-power_assert-0:0.2.6-69.el7
  • rh-ruby23-rubygem-psych-0:2.1.0.1-69.el6
  • rh-ruby23-rubygem-psych-0:2.1.0.1-69.el7
  • rh-ruby23-rubygem-rake-0:10.4.2-69.el6
  • rh-ruby23-rubygem-rake-0:10.4.2-69.el7
  • rh-ruby23-rubygem-rdoc-0:4.2.1-69.el6
  • rh-ruby23-rubygem-rdoc-0:4.2.1-69.el7
  • rh-ruby23-rubygem-test-unit-0:3.1.5-69.el6
  • rh-ruby23-rubygem-test-unit-0:3.1.5-69.el7
  • rh-ruby23-rubygems-0:2.5.2.3-69.el6
  • rh-ruby23-rubygems-0:2.5.2.3-69.el7
  • rh-ruby23-rubygems-devel-0:2.5.2.3-69.el6
  • rh-ruby23-rubygems-devel-0:2.5.2.3-69.el7
  • rh-ruby24-ruby-0:2.4.5-91.el6
  • rh-ruby24-ruby-0:2.4.5-91.el7
  • rh-ruby24-ruby-debuginfo-0:2.4.5-91.el6
  • rh-ruby24-ruby-debuginfo-0:2.4.5-91.el7
  • rh-ruby24-ruby-devel-0:2.4.5-91.el6
  • rh-ruby24-ruby-devel-0:2.4.5-91.el7
  • rh-ruby24-ruby-doc-0:2.4.5-91.el6
  • rh-ruby24-ruby-doc-0:2.4.5-91.el7
  • rh-ruby24-ruby-irb-0:2.4.5-91.el6
  • rh-ruby24-ruby-irb-0:2.4.5-91.el7
  • rh-ruby24-ruby-libs-0:2.4.5-91.el6
  • rh-ruby24-ruby-libs-0:2.4.5-91.el7
  • rh-ruby24-rubygem-bigdecimal-0:1.3.2-91.el6
  • rh-ruby24-rubygem-bigdecimal-0:1.3.2-91.el7
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-91.el6
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-91.el7
  • rh-ruby24-rubygem-io-console-0:0.4.6-91.el6
  • rh-ruby24-rubygem-io-console-0:0.4.6-91.el7
  • rh-ruby24-rubygem-json-0:2.0.4-91.el6
  • rh-ruby24-rubygem-json-0:2.0.4-91.el7
  • rh-ruby24-rubygem-minitest-0:5.10.1-91.el6
  • rh-ruby24-rubygem-minitest-0:5.10.1-91.el7
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-91.el6
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-91.el7
  • rh-ruby24-rubygem-openssl-0:2.0.9-91.el6
  • rh-ruby24-rubygem-openssl-0:2.0.9-91.el7
  • rh-ruby24-rubygem-power_assert-0:0.4.1-91.el6
  • rh-ruby24-rubygem-power_assert-0:0.4.1-91.el7
  • rh-ruby24-rubygem-psych-0:2.2.2-91.el6
  • rh-ruby24-rubygem-psych-0:2.2.2-91.el7
  • rh-ruby24-rubygem-rake-0:12.0.0-91.el6
  • rh-ruby24-rubygem-rake-0:12.0.0-91.el7
  • rh-ruby24-rubygem-rdoc-0:5.0.0-91.el6
  • rh-ruby24-rubygem-rdoc-0:5.0.0-91.el7
  • rh-ruby24-rubygem-test-unit-0:3.2.3-91.el6
  • rh-ruby24-rubygem-test-unit-0:3.2.3-91.el7
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-91.el6
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-91.el7
  • rh-ruby24-rubygems-0:2.6.14.3-91.el6
  • rh-ruby24-rubygems-0:2.6.14.3-91.el7
  • rh-ruby24-rubygems-devel-0:2.6.14.3-91.el6
  • rh-ruby24-rubygems-devel-0:2.6.14.3-91.el7
  • rh-ruby25-ruby-0:2.5.3-6.el7
  • rh-ruby25-ruby-debuginfo-0:2.5.3-6.el7
  • rh-ruby25-ruby-devel-0:2.5.3-6.el7
  • rh-ruby25-ruby-doc-0:2.5.3-6.el7
  • rh-ruby25-ruby-irb-0:2.5.3-6.el7
  • rh-ruby25-ruby-libs-0:2.5.3-6.el7
  • rh-ruby25-rubygem-bigdecimal-0:1.3.4-6.el7
  • rh-ruby25-rubygem-did_you_mean-0:1.2.0-6.el7
  • rh-ruby25-rubygem-io-console-0:0.4.6-6.el7
  • rh-ruby25-rubygem-json-0:2.1.0-6.el7
  • rh-ruby25-rubygem-minitest-0:5.10.3-6.el7
  • rh-ruby25-rubygem-net-telnet-0:0.1.1-6.el7
  • rh-ruby25-rubygem-openssl-0:2.1.2-6.el7
  • rh-ruby25-rubygem-power_assert-0:1.1.1-6.el7
  • rh-ruby25-rubygem-psych-0:3.0.2-6.el7
  • rh-ruby25-rubygem-rake-0:12.3.0-6.el7
  • rh-ruby25-rubygem-rdoc-0:6.0.1-6.el7
  • rh-ruby25-rubygem-test-unit-0:3.2.7-6.el7
  • rh-ruby25-rubygem-xmlrpc-0:0.3.0-6.el7
  • rh-ruby25-rubygems-0:2.7.6-6.el7
  • rh-ruby25-rubygems-devel-0:2.7.6-6.el7
  • ruby-0:2.0.0.648-36.el7
  • ruby-debuginfo-0:2.0.0.648-36.el7
  • ruby-devel-0:2.0.0.648-36.el7
  • ruby-doc-0:2.0.0.648-36.el7
  • ruby-irb-0:2.0.0.648-36.el7
  • ruby-libs-0:2.0.0.648-36.el7
  • ruby-tcltk-0:2.0.0.648-36.el7
  • rubygem-bigdecimal-0:1.2.0-36.el7
  • rubygem-io-console-0:0.4.2-36.el7
  • rubygem-json-0:1.7.7-36.el7
  • rubygem-minitest-0:4.3.2-36.el7
  • rubygem-psych-0:2.0.0-36.el7
  • rubygem-rake-0:0.9.6-36.el7
  • rubygem-rdoc-0:4.0.0-36.el7
  • rubygems-0:2.0.14.1-36.el7
  • rubygems-devel-0:2.0.14.1-36.el7
  • ruby-0:2.0.0.648-35.el7_5
  • ruby-debuginfo-0:2.0.0.648-35.el7_5
  • ruby-devel-0:2.0.0.648-35.el7_5
  • ruby-doc-0:2.0.0.648-35.el7_5
  • ruby-irb-0:2.0.0.648-35.el7_5
  • ruby-libs-0:2.0.0.648-35.el7_5
  • ruby-tcltk-0:2.0.0.648-35.el7_5
  • rubygem-bigdecimal-0:1.2.0-35.el7_5
  • rubygem-io-console-0:0.4.2-35.el7_5
  • rubygem-json-0:1.7.7-35.el7_5
  • rubygem-minitest-0:4.3.2-35.el7_5
  • rubygem-psych-0:2.0.0-35.el7_5
  • rubygem-rake-0:0.9.6-35.el7_5
  • rubygem-rdoc-0:4.0.0-35.el7_5
  • rubygems-0:2.0.14.1-35.el7_5
  • rubygems-devel-0:2.0.14.1-35.el7_5
  • ruby-0:2.0.0.648-35.el7_4
  • ruby-debuginfo-0:2.0.0.648-35.el7_4
  • ruby-devel-0:2.0.0.648-35.el7_4
  • ruby-doc-0:2.0.0.648-35.el7_4
  • ruby-irb-0:2.0.0.648-35.el7_4
  • ruby-libs-0:2.0.0.648-35.el7_4
  • ruby-tcltk-0:2.0.0.648-35.el7_4
  • rubygem-bigdecimal-0:1.2.0-35.el7_4
  • rubygem-io-console-0:0.4.2-35.el7_4
  • rubygem-json-0:1.7.7-35.el7_4
  • rubygem-minitest-0:4.3.2-35.el7_4
  • rubygem-psych-0:2.0.0-35.el7_4
  • rubygem-rake-0:0.9.6-35.el7_4
  • rubygem-rdoc-0:4.0.0-35.el7_4
  • rubygems-0:2.0.14.1-35.el7_4
  • rubygems-devel-0:2.0.14.1-35.el7_4
  • ruby-0:2.0.0.648-36.el7_6
  • ruby-debuginfo-0:2.0.0.648-36.el7_6
  • ruby-devel-0:2.0.0.648-36.el7_6
  • ruby-doc-0:2.0.0.648-36.el7_6
  • ruby-irb-0:2.0.0.648-36.el7_6
  • ruby-libs-0:2.0.0.648-36.el7_6
  • ruby-tcltk-0:2.0.0.648-36.el7_6
  • rubygem-bigdecimal-0:1.2.0-36.el7_6
  • rubygem-io-console-0:0.4.2-36.el7_6
  • rubygem-json-0:1.7.7-36.el7_6
  • rubygem-minitest-0:4.3.2-36.el7_6
  • rubygem-psych-0:2.0.0-36.el7_6
  • rubygem-rake-0:0.9.6-36.el7_6
  • rubygem-rdoc-0:4.0.0-36.el7_6
  • rubygems-0:2.0.14.1-36.el7_6
  • rubygems-devel-0:2.0.14.1-36.el7_6