An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-bson-docUpgrade rubygem-mysql2-doc | May 4, 2022 | Aug 1, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Aug 1, 2021 |
| Amazon Linux Ami 2 | — | Upgrade ruby-docUpgrade rubygem-opensslUpgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-rssUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-rexmlUpgrade rubygem-xmlrpcUpgrade ruby-tcltkUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-psych | Sep 28, 2023 | Aug 1, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 1, 2021 |
| Centos_linux | — | Upgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-io-console-debuginfoUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-psych-debuginfoUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfo | Aug 6, 2021 | Aug 1, 2021 |
| Debian | — | Upgrade jrubyUpgrade ruby2.7 | Nov 29, 2021 | Aug 1, 2021 |
| Freebsd | — | Upgrade rubyUpgrade ruby30Upgrade ruby26 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Oct 26, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 12, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 24, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 12, 2021 | Aug 1, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Aug 1, 2021 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygem-minitest | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-xmlrpcUpgrade ruby-libs-debuginfoUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-net-telnetUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade rubygemsUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade ruby-default-gemsNo solution existsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimal-debuginfo | Aug 6, 2021 | Aug 1, 2021 |
| Rocky_linux | — | Upgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-openssl | Mar 5, 2024 | Aug 1, 2021 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.1-develUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.1-stdlib | Dec 2, 2021 | Jul 21, 2021 |
| Ubuntu | — | Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.5Upgrade ruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5Upgrade libruby2.7 | Jul 22, 2021 | Jul 21, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub