I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-band from the OS updates to allow differernt projects to use different Rails stacks.
I believe the actual Ruby version in use is 2.3.5, but you can't tell that from the Ubuntu package utilities. It's been like this for years, but recent security policies are pushing us in the direction of proving we are on top of these updates and I can't just check a box that says "web developers say it's OK".
I've tried bundle show
and to get a list of Ruby gems in use in the current (directory) project, but any single server may have several branches of projects, with many different versioins of gems in use in each branch. I couldn't tell you for sure which systems/projects are up-to-date with current patch levels.
The developers don't really care to be involved with the security aspects but if I take some hard data to managmement and say "This system is running vulnerable version X.X. This is the CVE. We are not patched" my job is done.
Is there an easier way to get current Ruby/Bundler/Gems versions other than some ugly find /var/www -name Gemfile -exec ...
shell-fu ?