Debian dla-4163 : bundler - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4163. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(236773);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/15");

  script_cve_id("CVE-2021-43809", "CVE-2023-28755", "CVE-2025-27221");

  script_name(english:"Debian dla-4163 : bundler - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4163 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4163-1                [email protected]
    https://www.debian.org/lts/security/                      Lucas Kanashiro
    May 12, 2025                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : rubygems
    Version        : 3.2.5-2+deb11u1
    CVE ID         : CVE-2021-43809 CVE-2023-28755 CVE-2025-27221

    Multiple vulnerabilities were found in rubygems, which contains a package
    management framework for Ruby and a dependency manager for Ruby applications.

    CVE-2021-43809

        In bundler versions before 2.2.33, when working with untrusted and
        apparently harmless `Gemfile`'s, it is not expected that they lead to
        execution of external code, unless that's explicit in the ruby code inside
        the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that
        use the `git` option with invalid, but seemingly harmless, values with a
        leading dash, this can be false. To handle dependencies that come from a
        Git repository instead of a registry, Bundler uses various commands, such
        as `git clone`.  These commands are being constructed using user input
        (e.g.  the repository URL). When building the commands, Bundler versions
        before 2.2.33 correctly avoid Command Injection vulnerabilities by passing
        an array of arguments instead of a command string.  However, there is the
        possibility that a user input starts with a dash (`-`) and is therefore
        treated as an optional argument instead of a positional one.  This can lead
        to Code Execution because some of the commands have options that can be
        leveraged to run arbitrary executables.

    CVE-2023-28755

        A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby
        through 3.2.1. The URI parser mishandles invalid URLs that have specific
        characters. It causes an increase in execution time for parsing strings to
        URI objects.

    CVE-2025-27221

        The URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent
        leakage of authentication credentials because userinfo is retained even
        after changing the host.

    For Debian 11 bullseye, these problems have been fixed in version
    3.2.5-2+deb11u1.

    We recommend that you upgrade your rubygems packages.

    For the detailed security status of rubygems please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/rubygems

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/rubygems");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2021-43809");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-28755");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-27221");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/rubygems");
  script_set_attribute(attribute:"solution", value:
"Upgrade the bundler packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-43809");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-27221");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/12/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:bundler");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby-bundler");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ruby-rubygems");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'bundler', 'reference': '3.2.5-2+deb11u1'},
    {'release': '11.0', 'prefix': 'ruby-bundler', 'reference': '3.2.5-2+deb11u1'},
    {'release': '11.0', 'prefix': 'ruby-rubygems', 'reference': '3.2.5-2+deb11u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bundler / ruby-bundler / ruby-rubygems');
}