Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2018-2024 and is owned by Tenable, Inc. or an Affiliate thereof.REDHAT-RHSA-2018-0378.NASL
HistoryMar 01, 2018 - 12:00 a.m.

RHEL 7 : ruby (RHSA-2018:0378)

2018-03-0100:00:00
This script is Copyright (C) 2018-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
53

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.895 High

EPSS

Percentile

98.8%

JSON

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0378 advisory.

  • ruby: Buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898)

  • rubygems: Escape sequence in the summary field of gemspec (CVE-2017-0899)

  • rubygems: No size limit in summary length of gem spec (CVE-2017-0900)

  • rubygems: Arbitrary file overwrite due to incorrect validation of specification name (CVE-2017-0901)

  • rubygems: DNS hijacking vulnerability (CVE-2017-0902)

  • rubygems: Unsafe object deserialization through YAML formatted gem specifications (CVE-2017-0903)

  • ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick (CVE-2017-10784)

  • ruby: Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033)

  • ruby: Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064)

  • ruby: Command injection vulnerability in Net::FTP (CVE-2017-17405)

  • ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution (CVE-2017-17790)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2018:0378. The text 
# itself is copyright (C) Red Hat, Inc.
#

include('compat.inc');

if (description)
{
  script_id(107082);
  script_version("3.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/27");

  script_cve_id(
    "CVE-2017-0898",
    "CVE-2017-0899",
    "CVE-2017-0900",
    "CVE-2017-0901",
    "CVE-2017-0902",
    "CVE-2017-0903",
    "CVE-2017-10784",
    "CVE-2017-14033",
    "CVE-2017-14064",
    "CVE-2017-17405",
    "CVE-2017-17790"
  );
  script_xref(name:"RHSA", value:"2018:0378");

  script_name(english:"RHEL 7 : ruby (RHSA-2018:0378)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates for ruby.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2018:0378 advisory.

  - ruby: Buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898)

  - rubygems: Escape sequence in the summary field of gemspec (CVE-2017-0899)

  - rubygems: No size limit in summary length of gem spec (CVE-2017-0900)

  - rubygems: Arbitrary file overwrite due to incorrect validation of specification name (CVE-2017-0901)

  - rubygems: DNS hijacking vulnerability (CVE-2017-0902)

  - rubygems: Unsafe object deserialization through YAML formatted gem specifications (CVE-2017-0903)

  - ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick (CVE-2017-10784)

  - ruby: Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033)

  - ruby: Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064)

  - ruby: Command injection vulnerability in Net::FTP (CVE-2017-17405)

  - ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
    (CVE-2017-17790)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://access.redhat.com/security/data/csaf/v2/advisories/2018/rhsa-2018_0378.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c33ad6b9");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2018:0378");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/updates/classification/#important");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1487552");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1487587");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1487588");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1487589");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1487590");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1491866");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1492012");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1492015");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1500488");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1526189");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1528218");
  script_set_attribute(attribute:"solution", value:
"Update the RHEL ruby package based on the guidance in RHSA-2018:0378.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-17405");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2017-17790");
  script_cwe_id(117, 119, 122, 138, 20, 200, 77);
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/02/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-irb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-tcltk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-bigdecimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-io-console");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-json");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-minitest");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-psych");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rake");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rdoc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2018-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("redhat_repos.nasl", "ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'repo_relative_urls': [
      'content/dist/rhel-alt/server/7/7Server/armv8-a/aarch64/debug',
      'content/dist/rhel-alt/server/7/7Server/armv8-a/aarch64/optional/debug',
      'content/dist/rhel-alt/server/7/7Server/armv8-a/aarch64/optional/os',
      'content/dist/rhel-alt/server/7/7Server/armv8-a/aarch64/optional/source/SRPMS',
      'content/dist/rhel-alt/server/7/7Server/armv8-a/aarch64/os',
      'content/dist/rhel-alt/server/7/7Server/armv8-a/aarch64/source/SRPMS',
      'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/debug',
      'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/debug',
      'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/os',
      'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/optional/source/SRPMS',
      'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/os',
      'content/dist/rhel-alt/server/7/7Server/power9/ppc64le/source/SRPMS',
      'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/debug',
      'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/debug',
      'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/os',
      'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/optional/source/SRPMS',
      'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/os',
      'content/dist/rhel-alt/server/7/7Server/system-z-a/s390x/source/SRPMS',
      'content/dist/rhel/client/7/7.9/x86_64/debug',
      'content/dist/rhel/client/7/7.9/x86_64/optional/debug',
      'content/dist/rhel/client/7/7.9/x86_64/optional/os',
      'content/dist/rhel/client/7/7.9/x86_64/optional/source/SRPMS',
      'content/dist/rhel/client/7/7.9/x86_64/os',
      'content/dist/rhel/client/7/7.9/x86_64/source/SRPMS',
      'content/dist/rhel/client/7/7Client/x86_64/debug',
      'content/dist/rhel/client/7/7Client/x86_64/optional/debug',
      'content/dist/rhel/client/7/7Client/x86_64/optional/os',
      'content/dist/rhel/client/7/7Client/x86_64/optional/source/SRPMS',
      'content/dist/rhel/client/7/7Client/x86_64/os',
      'content/dist/rhel/client/7/7Client/x86_64/source/SRPMS',
      'content/dist/rhel/computenode/7/7.9/x86_64/optional/debug',
      'content/dist/rhel/computenode/7/7.9/x86_64/optional/os',
      'content/dist/rhel/computenode/7/7.9/x86_64/optional/source/SRPMS',
      'content/dist/rhel/computenode/7/7ComputeNode/x86_64/debug',
      'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/debug',
      'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/os',
      'content/dist/rhel/computenode/7/7ComputeNode/x86_64/optional/source/SRPMS',
      'content/dist/rhel/computenode/7/7ComputeNode/x86_64/os',
      'content/dist/rhel/computenode/7/7ComputeNode/x86_64/source/SRPMS',
      'content/dist/rhel/power-le/7/7.9/ppc64le/debug',
      'content/dist/rhel/power-le/7/7.9/ppc64le/highavailability/debug',
      'content/dist/rhel/power-le/7/7.9/ppc64le/highavailability/os',
      'content/dist/rhel/power-le/7/7.9/ppc64le/highavailability/source/SRPMS',
      'content/dist/rhel/power-le/7/7.9/ppc64le/optional/debug',
      'content/dist/rhel/power-le/7/7.9/ppc64le/optional/os',
      'content/dist/rhel/power-le/7/7.9/ppc64le/optional/source/SRPMS',
      'content/dist/rhel/power-le/7/7.9/ppc64le/os',
      'content/dist/rhel/power-le/7/7.9/ppc64le/resilientstorage/debug',
      'content/dist/rhel/power-le/7/7.9/ppc64le/resilientstorage/os',
      'content/dist/rhel/power-le/7/7.9/ppc64le/resilientstorage/source/SRPMS',
      'content/dist/rhel/power-le/7/7.9/ppc64le/source/SRPMS',
      'content/dist/rhel/power-le/7/7Server/ppc64le/debug',
      'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/debug',
      'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/os',
      'content/dist/rhel/power-le/7/7Server/ppc64le/highavailability/source/SRPMS',
      'content/dist/rhel/power-le/7/7Server/ppc64le/optional/debug',
      'content/dist/rhel/power-le/7/7Server/ppc64le/optional/os',
      'content/dist/rhel/power-le/7/7Server/ppc64le/optional/source/SRPMS',
      'content/dist/rhel/power-le/7/7Server/ppc64le/os',
      'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/debug',
      'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/os',
      'content/dist/rhel/power-le/7/7Server/ppc64le/resilientstorage/source/SRPMS',
      'content/dist/rhel/power-le/7/7Server/ppc64le/source/SRPMS',
      'content/dist/rhel/power/7/7.9/ppc64/debug',
      'content/dist/rhel/power/7/7.9/ppc64/optional/debug',
      'content/dist/rhel/power/7/7.9/ppc64/optional/os',
      'content/dist/rhel/power/7/7.9/ppc64/optional/source/SRPMS',
      'content/dist/rhel/power/7/7.9/ppc64/os',
      'content/dist/rhel/power/7/7.9/ppc64/source/SRPMS',
      'content/dist/rhel/power/7/7Server/ppc64/debug',
      'content/dist/rhel/power/7/7Server/ppc64/optional/debug',
      'content/dist/rhel/power/7/7Server/ppc64/optional/os',
      'content/dist/rhel/power/7/7Server/ppc64/optional/source/SRPMS',
      'content/dist/rhel/power/7/7Server/ppc64/os',
      'content/dist/rhel/power/7/7Server/ppc64/source/SRPMS',
      'content/dist/rhel/server/7/7.9/x86_64/debug',
      'content/dist/rhel/server/7/7.9/x86_64/highavailability/debug',
      'content/dist/rhel/server/7/7.9/x86_64/highavailability/os',
      'content/dist/rhel/server/7/7.9/x86_64/highavailability/source/SRPMS',
      'content/dist/rhel/server/7/7.9/x86_64/optional/debug',
      'content/dist/rhel/server/7/7.9/x86_64/optional/os',
      'content/dist/rhel/server/7/7.9/x86_64/optional/source/SRPMS',
      'content/dist/rhel/server/7/7.9/x86_64/os',
      'content/dist/rhel/server/7/7.9/x86_64/resilientstorage/debug',
      'content/dist/rhel/server/7/7.9/x86_64/resilientstorage/os',
      'content/dist/rhel/server/7/7.9/x86_64/resilientstorage/source/SRPMS',
      'content/dist/rhel/server/7/7.9/x86_64/source/SRPMS',
      'content/dist/rhel/server/7/7Server/x86_64/debug',
      'content/dist/rhel/server/7/7Server/x86_64/highavailability/debug',
      'content/dist/rhel/server/7/7Server/x86_64/highavailability/os',
      'content/dist/rhel/server/7/7Server/x86_64/highavailability/source/SRPMS',
      'content/dist/rhel/server/7/7Server/x86_64/optional/debug',
      'content/dist/rhel/server/7/7Server/x86_64/optional/os',
      'content/dist/rhel/server/7/7Server/x86_64/optional/source/SRPMS',
      'content/dist/rhel/server/7/7Server/x86_64/os',
      'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/debug',
      'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/os',
      'content/dist/rhel/server/7/7Server/x86_64/resilientstorage/source/SRPMS',
      'content/dist/rhel/server/7/7Server/x86_64/source/SRPMS',
      'content/dist/rhel/system-z/7/7.9/s390x/debug',
      'content/dist/rhel/system-z/7/7.9/s390x/highavailability/debug',
      'content/dist/rhel/system-z/7/7.9/s390x/highavailability/os',
      'content/dist/rhel/system-z/7/7.9/s390x/highavailability/source/SRPMS',
      'content/dist/rhel/system-z/7/7.9/s390x/optional/debug',
      'content/dist/rhel/system-z/7/7.9/s390x/optional/os',
      'content/dist/rhel/system-z/7/7.9/s390x/optional/source/SRPMS',
      'content/dist/rhel/system-z/7/7.9/s390x/os',
      'content/dist/rhel/system-z/7/7.9/s390x/resilientstorage/debug',
      'content/dist/rhel/system-z/7/7.9/s390x/resilientstorage/os',
      'content/dist/rhel/system-z/7/7.9/s390x/resilientstorage/source/SRPMS',
      'content/dist/rhel/system-z/7/7.9/s390x/source/SRPMS',
      'content/dist/rhel/system-z/7/7Server/s390x/debug',
      'content/dist/rhel/system-z/7/7Server/s390x/highavailability/debug',
      'content/dist/rhel/system-z/7/7Server/s390x/highavailability/os',
      'content/dist/rhel/system-z/7/7Server/s390x/highavailability/source/SRPMS',
      'content/dist/rhel/system-z/7/7Server/s390x/optional/debug',
      'content/dist/rhel/system-z/7/7Server/s390x/optional/os',
      'content/dist/rhel/system-z/7/7Server/s390x/optional/source/SRPMS',
      'content/dist/rhel/system-z/7/7Server/s390x/os',
      'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/debug',
      'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/os',
      'content/dist/rhel/system-z/7/7Server/s390x/resilientstorage/source/SRPMS',
      'content/dist/rhel/system-z/7/7Server/s390x/source/SRPMS',
      'content/dist/rhel/workstation/7/7.9/x86_64/debug',
      'content/dist/rhel/workstation/7/7.9/x86_64/optional/debug',
      'content/dist/rhel/workstation/7/7.9/x86_64/optional/os',
      'content/dist/rhel/workstation/7/7.9/x86_64/optional/source/SRPMS',
      'content/dist/rhel/workstation/7/7.9/x86_64/os',
      'content/dist/rhel/workstation/7/7.9/x86_64/source/SRPMS',
      'content/dist/rhel/workstation/7/7Workstation/x86_64/debug',
      'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/debug',
      'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/os',
      'content/dist/rhel/workstation/7/7Workstation/x86_64/optional/source/SRPMS',
      'content/dist/rhel/workstation/7/7Workstation/x86_64/os',
      'content/dist/rhel/workstation/7/7Workstation/x86_64/source/SRPMS',
      'content/fastrack/rhel/client/7/x86_64/debug',
      'content/fastrack/rhel/client/7/x86_64/optional/debug',
      'content/fastrack/rhel/client/7/x86_64/optional/os',
      'content/fastrack/rhel/client/7/x86_64/optional/source/SRPMS',
      'content/fastrack/rhel/client/7/x86_64/os',
      'content/fastrack/rhel/client/7/x86_64/source/SRPMS',
      'content/fastrack/rhel/computenode/7/x86_64/debug',
      'content/fastrack/rhel/computenode/7/x86_64/optional/debug',
      'content/fastrack/rhel/computenode/7/x86_64/optional/os',
      'content/fastrack/rhel/computenode/7/x86_64/optional/source/SRPMS',
      'content/fastrack/rhel/computenode/7/x86_64/os',
      'content/fastrack/rhel/computenode/7/x86_64/source/SRPMS',
      'content/fastrack/rhel/power/7/ppc64/debug',
      'content/fastrack/rhel/power/7/ppc64/optional/debug',
      'content/fastrack/rhel/power/7/ppc64/optional/os',
      'content/fastrack/rhel/power/7/ppc64/optional/source/SRPMS',
      'content/fastrack/rhel/power/7/ppc64/os',
      'content/fastrack/rhel/power/7/ppc64/source/SRPMS',
      'content/fastrack/rhel/server/7/x86_64/debug',
      'content/fastrack/rhel/server/7/x86_64/highavailability/debug',
      'content/fastrack/rhel/server/7/x86_64/highavailability/os',
      'content/fastrack/rhel/server/7/x86_64/highavailability/source/SRPMS',
      'content/fastrack/rhel/server/7/x86_64/optional/debug',
      'content/fastrack/rhel/server/7/x86_64/optional/os',
      'content/fastrack/rhel/server/7/x86_64/optional/source/SRPMS',
      'content/fastrack/rhel/server/7/x86_64/os',
      'content/fastrack/rhel/server/7/x86_64/resilientstorage/debug',
      'content/fastrack/rhel/server/7/x86_64/resilientstorage/os',
      'content/fastrack/rhel/server/7/x86_64/resilientstorage/source/SRPMS',
      'content/fastrack/rhel/server/7/x86_64/source/SRPMS',
      'content/fastrack/rhel/system-z/7/s390x/debug',
      'content/fastrack/rhel/system-z/7/s390x/optional/debug',
      'content/fastrack/rhel/system-z/7/s390x/optional/os',
      'content/fastrack/rhel/system-z/7/s390x/optional/source/SRPMS',
      'content/fastrack/rhel/system-z/7/s390x/os',
      'content/fastrack/rhel/system-z/7/s390x/source/SRPMS',
      'content/fastrack/rhel/workstation/7/x86_64/debug',
      'content/fastrack/rhel/workstation/7/x86_64/optional/debug',
      'content/fastrack/rhel/workstation/7/x86_64/optional/os',
      'content/fastrack/rhel/workstation/7/x86_64/optional/source/SRPMS',
      'content/fastrack/rhel/workstation/7/x86_64/os',
      'content/fastrack/rhel/workstation/7/x86_64/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'ruby-2.0.0.648-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ruby-devel-2.0.0.648-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ruby-doc-2.0.0.648-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ruby-irb-2.0.0.648-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ruby-libs-2.0.0.648-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'ruby-tcltk-2.0.0.648-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-bigdecimal-1.2.0-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-io-console-0.4.2-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-json-1.7.7-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-minitest-4.3.2-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-psych-2.0.0-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-rake-0.9.6-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygem-rdoc-4.0.0-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygems-2.0.14.1-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rubygems-devel-2.0.14.1-33.el7_4', 'release':'7', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);
if(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);

var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];
  foreach var pkg ( constraint_array['pkgs'] ) {
    var reference = NULL;
    var _release = NULL;
    var sp = NULL;
    var _cpu = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var epoch = NULL;
    var allowmaj = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        _release &&
        rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&
        (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&
        rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  if (isnull(applicable_repo_urls) || !applicable_repo_urls) extra = rpm_report_get() + redhat_report_repo_caveat();
  else extra = rpm_report_get();
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : extra
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc');
}
VendorProductVersionCPE
redhatenterprise_linuxrubyp-cpe:/a:redhat:enterprise_linux:ruby
redhatenterprise_linuxruby-develp-cpe:/a:redhat:enterprise_linux:ruby-devel
redhatenterprise_linuxruby-docp-cpe:/a:redhat:enterprise_linux:ruby-doc
redhatenterprise_linuxruby-irbp-cpe:/a:redhat:enterprise_linux:ruby-irb
redhatenterprise_linuxruby-libsp-cpe:/a:redhat:enterprise_linux:ruby-libs
redhatenterprise_linuxruby-tcltkp-cpe:/a:redhat:enterprise_linux:ruby-tcltk
redhatenterprise_linuxrubygem-bigdecimalp-cpe:/a:redhat:enterprise_linux:rubygem-bigdecimal
redhatenterprise_linuxrubygem-io-consolep-cpe:/a:redhat:enterprise_linux:rubygem-io-console
redhatenterprise_linuxrubygem-jsonp-cpe:/a:redhat:enterprise_linux:rubygem-json
redhatenterprise_linuxrubygem-minitestp-cpe:/a:redhat:enterprise_linux:rubygem-minitest
Rows per page:
1-10 of 161

References

Related

nessus 50
centos 1
oraclelinux 1
openvas 31
redhat 6
ibm 1
debian 9
amazon 2
ubuntu 6
slackware 2
osv 16
mageia 3
fedora 6
freebsd 2
ubuntucve 7
f5 2
gentoo 3
prion 6
nvd 5
debiancve 5
cve 5
cvelist 5
photon 1
alpinelinux 4
redhatcve 6
hackerone 3
checkpoint_advisories 1
veracode 5
exploitpack 1
seebug 1
zdt 1
github 2
nessus
nessus
Scientific Linux Security Update : ruby on SL7.x x86_64 (20180228)
2018-03-01 00:00:00
Oracle Linux 7 : ruby (ELSA-2018-0378)
2018-03-01 00:00:00
RHEL 6 / 7 : rh-ruby23-ruby (RHSA-2018:0585)
2024-04-27 00:00:00
centos
centos
ruby, rubygem, rubygems security update
2018-03-10 11:53:01
oraclelinux
oraclelinux
ruby security update
2018-02-28 00:00:00
openvas
openvas
CentOS Update for ruby CESA-2018:0378 centos7
2018-03-14 00:00:00
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2018-1066)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2018-1248)
2020-01-23 00:00:00
redhat
redhat
(RHSA-2018:0585) Important: rh-ruby23-ruby security, bug fix, and enhancement update
2018-03-26 09:13:23
(RHSA-2018:0378) Important: ruby security update
2018-02-28 16:24:33
(RHSA-2018:0583) Important: rh-ruby22-ruby security, bug fix, and enhancement update
2018-03-26 09:12:14
ibm
ibm
Security Bulletin: Vulnerabilities in Ruby affect PowerKVM
2018-06-18 01:42:18
debian
debian
[SECURITY] [DLA 1114-1] ruby1.9.1 security update
2017-09-26 21:16:53
[SECURITY] [DSA 4031-1] ruby2.3 security update
2017-11-11 14:46:00
[SECURITY] [DSA 4031-1] ruby2.3 security update
2017-11-11 14:46:00
amazon
amazon
Medium: ruby22, ruby23
2017-10-02 17:01:00
Medium: ruby24
2017-10-26 17:01:00
ubuntu
ubuntu
Ruby vulnerabilities
2017-10-05 00:00:00
Ruby vulnerabilities
2018-01-10 00:00:00
Ruby regression
2021-03-25 00:00:00
slackware
slackware
[slackware-security] ruby
2017-09-18 19:20:47
[slackware-security] ruby
2017-12-20 06:38:26
osv
osv
ruby1.9.1 - security update
2017-09-26 00:00:00
ruby2.3 - security update
2017-11-11 00:00:00
ruby2.3 - security update
2017-09-05 00:00:00
mageia
mageia
Updated ruby-RubyGems packages fix security vulnerabilities
2017-12-31 18:14:43
Updated ruby packages fix security vulnerabilities
2017-10-18 23:19:34
Updated ruby packages fix security vulnerabilities
2017-12-31 18:51:06
fedora
fedora
[SECURITY] Fedora 25 Update: ruby-2.3.4-64.fc25
2017-09-16 03:24:34
[SECURITY] Fedora 27 Update: rubygems-2.6.13-100.fc27
2017-09-30 07:26:40
[SECURITY] Fedora 26 Update: rubygems-2.6.13-100.fc26
2017-09-09 23:57:10
freebsd
freebsd
ruby -- multiple vulnerabilities
2017-09-14 00:00:00
ruby -- Command injection vulnerability in Net::FTP
2017-12-14 00:00:00
ubuntucve
ubuntucve
CVE-2017-0899
2017-08-31 00:00:00
CVE-2017-0900
2017-08-31 00:00:00
CVE-2017-17790
2017-12-20 00:00:00
f5
f5
K01730454 : Ruby vulnerabilities CVE-2017-0899, CVE-2017-0900, CVE-2017-0901, and CVE-2017-0902
2017-09-11 00:00:00
K91125274 : RubyGems vulnerability CVE-2017-0903
2022-04-14 00:00:00
gentoo
gentoo
RubyGems: Multiple vulnerabilities
2017-10-08 00:00:00
Ruby: Multiple vulnerabilities
2017-10-18 00:00:00
Ruby: Command injection
2018-02-20 00:00:00
prion
prion
Command injection
2017-12-20 09:29:00
Design/Logic Flaw
2017-09-19 17:29:00
Command injection
2017-12-15 09:29:00
nvd
nvd
CVE-2017-17790
2017-12-20 09:29:01
CVE-2017-14064
2017-08-31 17:29:00
CVE-2017-17405
2017-12-15 09:29:00
debiancve
debiancve
CVE-2017-17790
2017-12-20 09:29:01
CVE-2017-14033
2017-09-19 17:29:00
CVE-2017-17405
2017-12-15 09:29:00
cve
cve
CVE-2017-17790
2017-12-20 09:29:01
CVE-2017-10784
2017-09-19 17:29:00
CVE-2017-14064
2017-08-31 17:29:00
cvelist
cvelist
CVE-2017-17790
2017-12-20 09:00:00
CVE-2017-14033
2017-09-19 17:00:00
CVE-2017-17405
2017-12-15 09:00:00
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0100
2018-01-18 00:00:00
alpinelinux
alpinelinux
CVE-2017-14064
2017-08-31 17:29:00
CVE-2017-14033
2017-09-19 17:29:00
CVE-2017-17405
2017-12-15 09:29:00
redhatcve
redhatcve
CVE-2017-17790
2019-10-08 04:44:54
CVE-2017-14064
2017-09-01 09:18:32
CVE-2017-17405
2017-12-14 21:50:01
hackerone
hackerone
Ruby: NET::Ftp allows command injection in filenames
2017-12-02 11:33:02
Ruby: Arbitrary heap exposure in JSON.generate
2017-03-01 22:55:39
Ruby: Escape sequence injection vulnerability in WEBrick BasicAuth
2017-04-24 10:25:41
checkpoint_advisories
checkpoint_advisories
Ruby Net FTP Command Injection (CVE-2017-17405) - Ver2
2018-04-15 00:00:00
veracode
veracode
Arbitrary Command Execution
2019-01-15 09:21:10
Command Injection
2019-05-16 02:49:49
Buffer Overflow
2019-05-16 02:16:35
exploitpack
exploitpack
Ruby 2.2.8 2.3.5 2.4.2 2.5.0-preview1 - NET::Ftp Command Injection
2017-12-02 00:00:00
seebug
seebug
Command injection vulnerability in Net::FTP(CVE-2017-17405)
2017-12-18 00:00:00
zdt
zdt
Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - NET::Ftp Command Injection Exploit
2017-12-22 00:00:00
github
github
Ruby OpenSSL DoS Vulnerability
2022-05-14 02:03:26
WEBrick RCE Vulnerability
2022-05-14 02:03:29

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.895 High

EPSS

Percentile

98.8%

JSON
Related for REDHAT-RHSA-2018-0378.NASL
nessus50centos1oraclelinux1openvas31redhat6ibm1debian9amazon2ubuntu6slackware2osv16mageia3fedora6freebsd2ubuntucve7f52gentoo3prion6nvd5debiancve5cve5cvelist5photon1alpinelinux4redhatcve6hackerone3checkpoint_advisories1veracode5exploitpack1seebug1zdt1github2