The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2230 advisory.
– ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)
– ruby: Regular expression denial of service vulnerability of WEBrick’s Digest authentication (CVE-2019-16201)
– ruby: HTTP response splitting in WEBrick (CVE-2019-16254)
– ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)
– rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)
– rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)
– ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)
– ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)
– ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.Read More