An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-bundler-docUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-bson-docUpgrade rubygem-power_assertUpgrade rubygem-abrt | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade rubygem-rssUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-opensslUpgrade rubyUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-typeprof | Sep 28, 2023 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-pg-debugsourceUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-doc | Aug 6, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Jul 13, 2021 |
| Freebsd | — | Upgrade ruby30Upgrade ruby26Upgrade ruby | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Mar 22, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 2, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 12, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Oracle_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-bundler-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade ruby-irbUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-opensslUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-mongo | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade rubygem-abrtUpgrade rubygem-xmlrpcUpgrade rubygem-pgUpgrade rubygem-test-unitUpgrade rubyUpgrade rubygem-psych-debuginfoUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bundler-docUpgrade ruby-default-gemsNo solution existsUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade ruby-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-debugsourceUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade ruby-debugsource | Aug 6, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-psych-debuginfo | Mar 5, 2024 | Jul 13, 2021 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.1-develUpgrade ruby2.5-devel-extra | Dec 2, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.5Upgrade ruby2.5 | Jul 22, 2021 | Jul 13, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub