Lucene search

PRIOn knowledge basePRION:CVE-2021-32066

HistoryAug 01, 2021 - 7:15 p.m.

Code injection

2021-08-0119:15:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.5%

JSON

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.”

CPENameOperatorVersion
jd_edwards_enterpriseone_toolslt9.2.6.1
rubyge3.0.0
rubyle3.0.1
rubyge2.7.0
rubyle2.7.3
rubyge2.6.0
rubyle2.6.7

Name	Operator	Version
jd_edwards_enterpriseone_tools	lt	9.2.6.1
ruby	ge	3.0.0
ruby	le	3.0.1
ruby	ge	2.7.0
ruby	le	2.7.3
ruby	ge	2.6.0
ruby	le	2.6.7

References

github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a

hackerone.com/reports/1178562

lists.debian.org/debian-lts-announce/2021/10/msg00009.html

lists.debian.org/debian-lts-announce/2023/04/msg00033.html

security.gentoo.org/glsa/202401-27

security.netapp.com/advisory/ntap-20210902-0004/

www.oracle.com/security-alerts/cpuapr2022.html

www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/