An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-docUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubyUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-irbUpgrade ruby-default-gemsUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-rake | May 4, 2022 | Aug 1, 2021 |
| Alpine Linux | — | Upgrade ruby | Mar 26, 2024 | Aug 1, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rexmlUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade ruby-develUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade rubygem-rssUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby-tcltkUpgrade rubygem-typeprof | Sep 28, 2023 | Aug 1, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 1, 2021 |
| Centos_linux | — | Upgrade rubygem-net-telnetUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-bundlerUpgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-pg-debugsourceUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-bsonUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-pg-debuginfoUpgrade rubygems-develUpgrade rubygem-openssl-debuginfo | Aug 6, 2021 | Aug 1, 2021 |
| Debian | — | Upgrade ruby2.7Upgrade jruby | Nov 29, 2021 | Aug 1, 2021 |
| Freebsd | — | Upgrade ruby30Upgrade rubyUpgrade ruby26 | Nov 4, 2022 | Jul 14, 2021 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Jan 25, 2024 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Oct 26, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Nov 12, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 24, 2021 | Aug 1, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 12, 2021 | Aug 1, 2021 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.8-11.4.37.0.1.101.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.9-11.4.37.0.1.101.1 on Solaris 11.4 | Oct 12, 2021 | Aug 1, 2021 |
| Oracle_linux | — | Upgrade rubygem-bson-docUpgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade ruby | Aug 7, 2021 | Jul 7, 2021 |
| Redhat_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-bson-debuginfoUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade rubygem-pgNo solution existsUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfo | Aug 6, 2021 | Aug 1, 2021 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade ruby-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-devel | Mar 5, 2024 | Aug 1, 2021 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.1-devel | Dec 2, 2021 | Jul 21, 2021 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5Upgrade ruby2.5Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7 | Jul 22, 2021 | Jul 21, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub