An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade ruby-irbUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-mongo-docUpgrade rubygem-bundler-doc | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-net-telnetUpgrade ruby-tcltkUpgrade rubygemsUpgrade ruby-docUpgrade ruby-default-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade rubygem-test-unit | Sep 28, 2023 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-opensslUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade ruby-default-gemsUpgrade ruby-libs-debuginfoUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debuginfo | Aug 6, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Jul 13, 2021 |
| Freebsd | — | Upgrade rubyUpgrade ruby26Upgrade ruby30 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Mar 22, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Nov 2, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 12, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade ruby-default-gemsUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubyUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygemsUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-abrt | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade ruby-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bsonUpgrade rubygem-net-telnetUpgrade rubygem-bundlerUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceNo solution existsUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-abrt | Aug 6, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2 | Mar 5, 2024 | Jul 13, 2021 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.1-devel | Dec 2, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.7Upgrade ruby2.5Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.5 | Jul 22, 2021 | Jul 13, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub