An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-doc | May 4, 2022 | Aug 1, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Aug 1, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-rexmlUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-bundler | Sep 28, 2023 | Aug 1, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 1, 2021 |
| Centos_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-pg-debuginfoUpgrade rubygems-develUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-json-debuginfo | Aug 6, 2021 | Aug 1, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Aug 1, 2021 |
| Freebsd | — | Upgrade ruby26Upgrade ruby30Upgrade ruby | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Oct 26, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 12, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 24, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 12, 2021 | Aug 1, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Aug 1, 2021 |
| Oracle_linux | — | Upgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-xmlrpc | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade ruby-default-gemsNo solution existsUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-debugsourceUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bson-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-json-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfo | Aug 6, 2021 | Aug 1, 2021 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json | Mar 5, 2024 | Aug 1, 2021 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade libruby2_5-2_5Upgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-docUpgrade ruby2.5-doc-ri | Dec 2, 2021 | Jul 21, 2021 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.5Upgrade ruby2.7Upgrade ruby2.5Upgrade ruby2.3 (Ubuntu Pro) | Jul 22, 2021 | Jul 21, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub