Test ID:	1.3.6.1.4.1.25623.1.1.2.2020.1130
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2020-1130)
Summary:	The remote host is missing an update for the Huawei EulerOS 'ruby' package(s) announced via the EulerOS-SA-2020-1130 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'ruby' package(s) announced via the EulerOS-SA-2020-1130 advisory. Vulnerability Insight: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.(CVE-2019-16254) Affected Software/OS: 'ruby' package(s) on Huawei EulerOS V2.0SP5. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-16254 Bugtraq: 20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update (Google Search) https://seclists.org/bugtraq/2019/Dec/32 Bugtraq: 20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update (Google Search) https://seclists.org/bugtraq/2019/Dec/31 Debian Security Information: DSA-4586 (Google Search) https://www.debian.org/security/2019/dsa-4586 Debian Security Information: DSA-4587 (Google Search) https://www.debian.org/security/2019/dsa-4587 https://security.gentoo.org/glsa/202003-06 https://hackerone.com/reports/331984 https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html https://www.oracle.com/security-alerts/cpujan2020.html https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html SuSE Security Announcement: openSUSE-SU-2020:0395 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.