An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade rubygem-bsonUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubyUpgrade ruby-irbUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-mongo | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-power_assertUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade ruby-develUpgrade ruby-docUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-xmlrpc | Sep 28, 2023 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade ruby-debuginfoUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-pgUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade rubygem-json-debuginfoUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson | Aug 6, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Jul 13, 2021 |
| Freebsd | — | Upgrade ruby30Upgrade rubyUpgrade ruby26 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Mar 22, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Nov 2, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 12, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Oracle_linux | — | Upgrade rubygem-opensslUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-bundler-docUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-bson | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade ruby-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-io-consoleNo solution existsUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mongoUpgrade ruby-default-gemsUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-psych-debuginfo | Aug 6, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsource | Mar 5, 2024 | Jul 13, 2021 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.1-develUpgrade ruby2.5-devel-extra | Dec 2, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby2.5Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7 | Jul 22, 2021 | Jul 13, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub