Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6731.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6731-1)
Summary:	The remote host is missing an update for the 'yard' package(s) announced via the USN-6731-1 advisory.
Description:	Summary: The remote host is missing an update for the 'yard' package(s) announced via the USN-6731-1 advisory. Vulnerability Insight: It was discovered that YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-17042) It was discovered that yard before 0.9.20 is affected by a path traversal vulnerability, allowing HTTP requests to access arbitrary files under certain conditions. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1020001) Aviv Keller discovered that the 'frames.html' file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the 'frames.erb' template file. (CVE-2024-27285) Affected Software/OS: 'yard' package(s) on Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 23.10. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-17042 Common Vulnerability Exposure (CVE) ID: CVE-2019-1020001 https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html Common Vulnerability Exposure (CVE) ID: CVE-2024-27285 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MR3Z2E2UIZZ7YOR7R645EVSBGWMB2RGA/ https://github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa https://github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be https://github.com/lsegal/yard/pull/1538 https://github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.