An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubyUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-did_you_meanUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade ruby-default-gems | May 4, 2022 | Aug 1, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Aug 1, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-rexmlUpgrade rubygem-opensslUpgrade ruby-doc | Sep 28, 2023 | Aug 1, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 1, 2021 |
| Centos_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-bson-docUpgrade ruby-default-gemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-json-debuginfoUpgrade ruby-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade ruby-irb | Aug 6, 2021 | Aug 1, 2021 |
| Debian | — | Upgrade jrubyUpgrade ruby2.7 | Nov 29, 2021 | Aug 1, 2021 |
| Freebsd | — | Upgrade ruby26Upgrade rubyUpgrade ruby30 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Oct 26, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 12, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 24, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 12, 2021 | Aug 1, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Aug 1, 2021 |
| Oracle_linux | — | Upgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-abrtUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-pg-doc | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-abrt-docNo solution existsUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-irb | Aug 6, 2021 | Aug 1, 2021 |
| Rocky_linux | — | Upgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-develUpgrade ruby-debuginfo | Mar 5, 2024 | Aug 1, 2021 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade libruby2_1-2_1Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade ruby2.5-develUpgrade ruby2.5 | Dec 2, 2021 | Jul 21, 2021 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.5 | Jul 22, 2021 | Jul 21, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub