AlmaLinux 8 : pcs (ALSA-2025:19719)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:19719 advisory. rubygem-rack: Rack QueryParser has an unsafe default allowing paramslimit bypass via semicolon- separated parameters CVE-2025-59830 rack: Rack's unbounde...

[SECURITY] Fedora 41 Update: rubygem-rack-2.2.21-1.fc41

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a single...

Fedora 42 : rubygem-rack (2025-eae2126736)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-eae2126736 advisory. Update to Rack 2.2.21 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 43 : rubygem-rack (2025-b6e0f437b6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b6e0f437b6 advisory. Update to Rack 3.1.19 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 41 : rubygem-rack (2025-a35addbf9b)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a35addbf9b advisory. Update to Rack 2.2.21 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Photon OS 4.0: Rubygem PHSA-2025-4.0-0903

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0903. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Critical Photon OS Security Update - PHSA-2025-4.0-0903

Updates of 'polkit', 'rubygem-yajl-ruby', 'curl', 'lasso' packages of Photon OS have been released...

CVE-2025-12790

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

CVE-2025-12790 Rubygem-mqtt: rubygem-mqtt hostname validation

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

CVE-2025-12790

Rubygem MQTT is affected by CVE-2025-12790 due to lack of hostname validation in the MQTT library, enabling potential MITM attacks. The issue is described across multiple connected sources as a vulnerability in the Rubygem MQTT package where hostname verification is not performed by default, allo...

CVE-2025-12790 Rubygem-mqtt: rubygem-mqtt hostname validation

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

CVE-2025-12790 Rubygem-mqtt: rubygem-mqtt hostname validation

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

CVE-2025-12790

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

PT-2025-45694

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

MQTT does not validate hostnames

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

PT-2025-45377

Name of the Vulnerable Software and Affected Versions Rubygem MQTT affected versions not specified Description The Rubygem MQTT package did not have hostname validation enabled by default, which could allow for a Man-in-the-Middle MITM attack. This means a malicious actor could potentially...

CVE-2025-12790: Path Traversal: '\..\filename'

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

RockyLinux 8 : pcs (RLSA-2025:19719)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19719 advisory. rubygem-rack: Rack QueryParser has an unsafe default allowing paramslimit bypass via semicolon- separated parameters CVE-2025-59830 rack: Rack's unbound...

RHEL 9 : pcs (RHSA-2025:19736)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19736 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: rubygem-rack: Rack...

pcs security update

0.11.9-2.el96.2 - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack Resolves: RHEL-120943, RHEL-121036, RHEL-123631, RHEL-123644, RHEL-124942...