An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubyUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongo | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-xmlrpcUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade ruby-tcltkUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-irbUpgrade ruby-docUpgrade ruby | Sep 28, 2023 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-openssl-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade rubyUpgrade ruby-irbUpgrade rubygem-mongoUpgrade rubygem-pg-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade ruby-debuginfoUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtUpgrade rubygem-mysql2-docUpgrade ruby-libs-debuginfoUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg | Aug 6, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Jul 13, 2021 |
| Freebsd | — | Upgrade rubyUpgrade ruby26Upgrade ruby30 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Mar 22, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 2, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 12, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Oracle_linux | — | Upgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-abrtUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-bundler-docUpgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-rake | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-xmlrpcUpgrade ruby-default-gemsUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-bundler-docUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubyNo solution existsUpgrade rubygem-bsonUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfo | Aug 6, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsource | Mar 5, 2024 | Jul 13, 2021 |
| Suse | — | Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.1-develUpgrade ruby2.5-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade ruby2.1Upgrade ruby2.1-stdlib | Dec 2, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.5Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7 | Jul 22, 2021 | Jul 13, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub