Test ID:	1.3.6.1.4.1.25623.1.0.845008
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5020-1)
Summary:	The remote host is missing an update for the 'ruby2.3, ruby2.5, ruby2.7' package(s) announced via the USN-5020-1 advisory.
Description:	Summary: The remote host is missing an update for the 'ruby2.3, ruby2.5, ruby2.7' package(s) announced via the USN-5020-1 advisory. Vulnerability Insight: It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-31799) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to conduct port scans and service banner extractions. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-31810) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to perform machine-in-the-middle attackers to bypass the TLS protection. (CVE-2021-32066) Affected Software/OS: 'ruby2.3, ruby2.5, ruby2.7' package(s) on Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-31799 https://security.netapp.com/advisory/ntap-20210902-0004/ https://security.gentoo.org/glsa/202401-05 https://security-tracker.debian.org/tracker/CVE-2021-31799 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/ https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html Common Vulnerability Exposure (CVE) ID: CVE-2021-31810 https://security.netapp.com/advisory/ntap-20210917-0001/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/ https://security.gentoo.org/glsa/202401-27 https://hackerone.com/reports/1145454 https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html Common Vulnerability Exposure (CVE) ID: CVE-2021-32066 https://github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ https://hackerone.com/reports/1178562
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.