An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygemsUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-power_assert | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-rbsUpgrade rubygem-rss | Sep 28, 2023 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade rubygem-irbUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-power_assertUpgrade rubygem-pg-debugsourceUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade ruby-debugsource | Aug 6, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Jul 13, 2021 |
| Freebsd | — | Upgrade ruby26Upgrade rubyUpgrade ruby30 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Mar 22, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 2, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 12, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Oracle_linux | — | Upgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubyUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-abrt | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docNo solution existsUpgrade rubygems-develUpgrade rubygem-abrtUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-mongoUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade ruby | Aug 6, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade rubygem-bigdecimalUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2 | Mar 5, 2024 | Jul 13, 2021 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.1-devel | Dec 2, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.7Upgrade libruby2.5Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro) | Jul 22, 2021 | Jul 13, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub