The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2230 advisory.

– ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

– ruby: Regular expression denial of service vulnerability of WEBrick’s Digest authentication (CVE-2019-16201)

– ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

– ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

– rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)

– rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

– ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

– ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

– ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.Read More