CVE-2018-8780 - Path Traversal vulnerability in multiple products

ID

ID

CVE-2018-8780
Last update

Last update

2019-07-21
Published

Published

2018-04-03
Summary

Summary

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Vulnerable Configurations

Vulnerable Configurations

CVSS

CVSS

Base: 7.5 (as of 21-07-2019 - 12:15)
Impact: n/a
Exploitability: n/a
CWE

CWE

CWE-22 - Path Traversal
CAPEC

CAPEC

  • Relative Path Traversal
    An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
  • Directory Traversal
    An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.
  • File System Function Injection, Content Based
    An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic
    This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access

Access

Vector Complexity Authentication
NETWORK LOW NONE
Impact

Impact

Confidentiality Integrity Availability
PARTIAL PARTIAL PARTIAL
Nessus

Nessus

  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0221_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ruby packages installed that are affected by multiple vulnerabilities: - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. (CVE-2018-8778) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780) - Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. (CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. (CVE-2018-16396) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. (CVE-2018-8779) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-01-01
    modified2020-01-02
    plugin id131412
    published2019-12-02
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131412
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0221)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1207.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application
    last seen2020-01-01
    modified2020-01-02
    plugin id110871
    published2018-07-03
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110871
    titleEulerOS 2.0 SP3 : ruby (EulerOS-SA-2018-1207)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1275.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application
    last seen2020-01-01
    modified2020-01-02
    plugin id117584
    published2018-09-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117584
    titleEulerOS Virtualization 2.5.1 : ruby (EulerOS-SA-2018-1275)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1428.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.(CVE-2012-4466) - The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.(CVE-2014-8090) - Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.(CVE-2013-4287) - The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.(CVE-2014-8080) - The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a
    last seen2020-01-01
    modified2020-01-02
    plugin id124931
    published2019-05-14
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124931
    titleEulerOS Virtualization 3.0.1.0 : ruby (EulerOS-SA-2019-1428)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190806_RUBY_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - ruby: HTTP response splitting in WEBrick (CVE-2017-17742) - ruby: DoS by large request in WEBrick (CVE-2018-8777) - ruby: Buffer under-read in String#unpack (CVE-2018-8778) - ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) - ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) - rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) - rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) - rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) - rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) - rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) - rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) - ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) - ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) - rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075)
    last seen2020-01-01
    modified2020-01-02
    plugin id128260
    published2019-08-27
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128260
    titleScientific Linux Security Update : ruby on SL7.x x86_64
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1276.NASL
    descriptionIt was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory. (CVE-2018-8777) It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory. (CVE-2018-6914) It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server
    last seen2020-01-01
    modified2020-01-02
    plugin id128290
    published2019-08-28
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128290
    titleAmazon Linux 2 : ruby (ALAS-2019-1276)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1804-1.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: Fixed Net::POPMail methods modify frozen literal when using default arg ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: Add a new helper for bundled ruby gems. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-01-09
    modified2020-01-02
    plugin id126617
    published2019-07-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126617
    titleSUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2028.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-01-01
    modified2020-01-02
    plugin id128332
    published2019-08-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128332
    titleCentOS 7 : ruby (CESA-2019:2028)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1359.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. For Debian 7
    last seen2020-01-01
    modified2020-01-02
    plugin id109284
    published2018-04-24
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109284
    titleDebian DLA-1359-1 : ruby1.8 security update
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_EB69BCF218EF4AA2BB0C83B263364089.NASL
    descriptionRuby news : CVE-2017-17742: HTTP response splitting in WEBrick If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients. CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir Dir.mktmpdir method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. The prefix can contain relative directory specifiers
    last seen2020-01-01
    modified2020-01-02
    plugin id108739
    published2018-03-30
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108739
    titleFreeBSD : ruby -- multiple vulnerabilities (eb69bcf2-18ef-4aa2-bb0c-83b263364089)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1206.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application
    last seen2020-01-01
    modified2020-01-02
    plugin id110870
    published2018-07-03
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110870
    titleEulerOS 2.0 SP2 : ruby (EulerOS-SA-2018-1206)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2018-004.NASL
    descriptionThe remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities.
    last seen2020-01-01
    modified2020-01-02
    plugin id111136
    published2018-07-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111136
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-DD8162C004.NASL
    description - Rebase to Ruby 2.5.1. - Several CVE fixes. - Conflict requirement needs to generate dependency. - Stop using --with-setjmp-type=setjmp on aarch64. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-01-01
    modified2020-01-02
    plugin id120846
    published2019-01-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120846
    titleFedora 28 : ruby (2018-dd8162c004)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0245_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ruby packages installed that are affected by multiple vulnerabilities: - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. (CVE-2018-8778) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. (CVE-2018-8780) - Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. (CVE-2018-6914) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). (CVE-2018-8777) - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. (CVE-2017-17742) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. (CVE-2018-16396) - In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. (CVE-2018-8779) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-01-03
    modified2020-01-02
    plugin id132492
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132492
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : ruby Multiple Vulnerabilities (NS-SA-2019-0245)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-A459ACD54B.NASL
    descriptionBackport `rubygem.macros` changes. Enables maintaners to build rubygems using same macros in all Fedoras. ---- Rebase to Ruby 2.4.4. Includes several CVE fixes. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-01-01
    modified2020-01-02
    plugin id110389
    published2018-06-07
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110389
    titleFedora 27 : ruby (2018-a459acd54b)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4259.NASL
    descriptionSeveral vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure. This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.
    last seen2020-01-01
    modified2020-01-02
    plugin id111468
    published2018-08-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111468
    titleDebian DSA-4259-1 : ruby2.3 - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1771.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes : - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper : - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-01-09
    modified2020-01-02
    plugin id126904
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126904
    titleopenSUSE Security Update : ruby-bundled-gems-rpmhelper / ruby2.5 (openSUSE-2019-1771)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2018-983.NASL
    descriptionPath traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) Improper verification of signatures in tarball allows to install mis-signed gem : RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) Infinite loop vulnerability due to negative size in tar header causes Denial of Service RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution : The
    last seen2020-01-01
    modified2020-01-02
    plugin id108846
    published2018-04-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108846
    titleAmazon Linux AMI : ruby20 / ruby22,ruby23,ruby24 (ALAS-2018-983)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1358.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7
    last seen2020-01-01
    modified2020-01-02
    plugin id109283
    published2018-04-24
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109283
    titleDebian DLA-1358-1 : ruby1.9.1 security update
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2028.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-01-07
    modified2020-01-02
    plugin id127649
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127649
    titleRHEL 7 : ruby (RHSA-2019:2028)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1421.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-9096 SMTP command injection in Net::SMTP via CRLF sequences in a RCPT TO or MAIL FROM command. CVE-2016-2339 Exploitable heap overflow in Fiddle::Function.new. CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf. CVE-2017-0899 ANSI escape sequence vulnerability in RubyGems. CVE-2017-0900 DoS vulnerability in the RubyGems query command. CVE-2017-0901 gem installer allowed a malicious gem to overwrite arbitrary files. CVE-2017-0902 RubyGems DNS request hijacking vulnerability. CVE-2017-0903 Max Justicz reported that RubyGems is prone to an unsafe object deserialization vulnerability. When parsed by an application which processes gems, a specially crafted YAML formatted gem specification can lead to remote code execution. CVE-2017-10784 Yusuke Endoh discovered an escape sequence injection vulnerability in the Basic authentication of WEBrick. An attacker can take advantage of this flaw to inject malicious escape sequences to the WEBrick log and potentially execute control characters on the victim
    last seen2020-01-01
    modified2020-01-02
    plugin id111081
    published2018-07-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111081
    titleDebian DLA-1421-1 : ruby2.1 security update
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2018-005.NASL
    descriptionThe remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - afpserver - AppleGraphicsControl - APR - ATS - CFNetwork - CoreAnimation - CoreCrypto - CoreFoundation - CUPS - Dictionary - dyld - Foundation - Heimdal - Hypervisor - ICU - Intel Graphics Driver - IOGraphics - IOHIDFamily - IOKit - IOUserEthernet - IPSec - Kernel - Login Window - mDNSOffloadUserClient - MediaRemote - Microcode - Perl - Ruby - Security - Spotlight - Symptom Framework - WiFi
    last seen2020-01-01
    modified2020-01-02
    plugin id118573
    published2018-10-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118573
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-005)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2018-088-01.NASL
    descriptionNew ruby packages are available for Slackware 14.2 and -current to fix security issues.
    last seen2020-01-01
    modified2020-01-02
    plugin id108725
    published2018-03-30
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108725
    titleSlackware 14.2 / current : ruby (SSA:2018-088-01)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_10_13_6.NASL
    descriptionThe remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-01-01
    modified2020-01-02
    plugin id111137
    published2018-07-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111137
    titlemacOS 10.13.x < 10.13.6 Multiple Vulnerabilities
Redhat

Redhat

advisories
  • bugzilla
    id1643089
    titleCVE-2018-16396 ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070026004
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentruby-irb is earlier than 0:2.0.0.648-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028001
          • commentruby-irb is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110910018
        • AND
          • commentrubygems is earlier than 0:2.0.14.1-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028003
          • commentrubygems is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20131441002
        • AND
          • commentrubygem-rdoc is earlier than 0:4.0.0-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028005
          • commentrubygem-rdoc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912006
        • AND
          • commentrubygem-bigdecimal is earlier than 0:1.2.0-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028007
          • commentrubygem-bigdecimal is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912016
        • AND
          • commentrubygem-json is earlier than 0:1.7.7-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028009
          • commentrubygem-json is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912012
        • AND
          • commentruby is earlier than 0:2.0.0.648-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028011
          • commentruby is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110910014
        • AND
          • commentrubygem-psych is earlier than 0:2.0.0-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028013
          • commentrubygem-psych is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912018
        • AND
          • commentrubygem-io-console is earlier than 0:0.4.2-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028015
          • commentrubygem-io-console is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912008
        • AND
          • commentruby-libs is earlier than 0:2.0.0.648-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028017
          • commentruby-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110910010
        • AND
          • commentruby-doc is earlier than 0:2.0.0.648-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028019
          • commentruby-doc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912024
        • AND
          • commentrubygem-minitest is earlier than 0:4.3.2-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028021
          • commentrubygem-minitest is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912030
        • AND
          • commentrubygems-devel is earlier than 0:2.0.14.1-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028023
          • commentrubygems-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912028
        • AND
          • commentrubygem-rake is earlier than 0:0.9.6-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028025
          • commentrubygem-rake is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20141912026
        • AND
          • commentruby-devel is earlier than 0:2.0.0.648-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028027
          • commentruby-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110910006
        • AND
          • commentruby-tcltk is earlier than 0:2.0.0.648-36.el7
            ovaloval:com.redhat.rhsa:tst:20192028029
          • commentruby-tcltk is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110910008
    rhsa
    idRHSA-2019:2028
    released2019-08-06
    severityModerate
    titleRHSA-2019:2028: ruby security update (Moderate)
  • rhsa
    idRHSA-2018:3729
  • rhsa
    idRHSA-2018:3730
  • rhsa
    idRHSA-2018:3731
rpms
  • ruby-irb-0:2.0.0.648-36.el7
  • rubygems-0:2.0.14.1-36.el7
  • rubygem-rdoc-0:4.0.0-36.el7
  • rubygem-bigdecimal-0:1.2.0-36.el7
  • rubygem-json-0:1.7.7-36.el7
  • ruby-0:2.0.0.648-36.el7
  • rubygem-psych-0:2.0.0-36.el7
  • rubygem-io-console-0:0.4.2-36.el7
  • ruby-libs-0:2.0.0.648-36.el7
  • ruby-doc-0:2.0.0.648-36.el7
  • rubygem-minitest-0:4.3.2-36.el7
  • rubygems-devel-0:2.0.14.1-36.el7
  • rubygem-rake-0:0.9.6-36.el7
  • ruby-devel-0:2.0.0.648-36.el7
  • ruby-tcltk-0:2.0.0.648-36.el7
Refmap

Refmap

bid103739
confirm
debianDSA-4259
mlist
  • [debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update
  • [debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update
  • [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
sectrack1042004
suseopenSUSE-SU-2019:1771
ubuntuUSN-3626-1
References

References