RHEL 8 : ruby:2.6 (RHSA-2022:0581)


The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0581 advisory. - ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845) - ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201) - ruby: HTTP response splitting in WEBrick (CVE-2019-16254) - ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255) - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663) - ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933) - ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613) - rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) - ruby: XML round-trip vulnerability in REXML (CVE-2021-28965) - rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) - ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810) - ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) - ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817) - ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.