An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-mongo-docUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-mysql2Upgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubygem-pg | May 4, 2022 | Jul 13, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Jul 13, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-power_assertUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-openssl | Sep 28, 2023 | Jul 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 13, 2021 |
| Centos_linux | — | Upgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-abrtUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-json-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-abrt-doc | Aug 6, 2021 | Jul 13, 2021 |
| Debian | — | Upgrade jrubyUpgrade ruby2.7 | Nov 29, 2021 | Jul 13, 2021 |
| Freebsd | — | Upgrade ruby30Upgrade rubyUpgrade ruby26 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Mar 22, 2022 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 2, 2021 | Jul 13, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 12, 2021 | Jul 13, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Jul 13, 2021 |
| Oracle_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubyUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade ruby-irbUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-bundler-docUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-mongo-doc | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade rubygem-abrtNo solution existsUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade ruby-debugsource | Aug 6, 2021 | Jul 13, 2021 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade ruby-libs-debuginfoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psych | Mar 5, 2024 | Jul 13, 2021 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.5Upgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.1 | Dec 2, 2021 | Jul 13, 2021 |
| Ubuntu | — | Upgrade ruby2.5Upgrade libruby2.5Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7 | Jul 22, 2021 | Jul 13, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub