Lucene search

K
archlinuxArchLinuxASA-202107-23
HistoryJul 14, 2021 - 12:00 a.m.

[ASA-202107-23] ruby: multiple issues

2021-07-1400:00:00
security.archlinux.org
194

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

Arch Linux Security Advisory ASA-202107-23

Severity: High
Date : 2021-07-14
CVE-ID : CVE-2021-31810 CVE-2021-32066
Package : ruby
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2138

Summary

The package ruby before version 3.0.2-1 is vulnerable to multiple
issues including silent downgrade and information disclosure.

Resolution

Upgrade to 3.0.2-1.

pacman -Syu β€œruby>=3.0.2-1”

The problems have been fixed upstream in version 3.0.2.

Workaround

None.

Description

  • CVE-2021-31810 (information disclosure)

A security issue has been discovered in Ruby before versions 3.0.2,
2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to
trick Net::FTP into connecting back to a given IP address and port.
This potentially makes Net::FTP extract information about services that
are otherwise private and not disclosed (e.g., the attacker can conduct
port scans and service banner extractions).

  • CVE-2021-32066 (silent downgrade)

A security issue has been discovered in Ruby before versions 3.0.2,
2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS
fails with an unknown response, which might allow man-in-the-middle
attackers to bypass the TLS protections by leveraging a network
position between the client and the registry to block the StartTLS
command, aka a β€œStartTLS stripping attack”.

Impact

A remote man-in-the-middle attacker could strip StartTLS encryption
from IMAP connections to disclose authentication credentials and
emails. Furthermore, a malicious FTP server could induce connections to
an arbitrary IP address and port on a client, leading to potential
information disclosure.

References

https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/
https://hackerone.com/reports/1145454
https://github.com/ruby/net-ftp/commit/5709ece67cf57a94655e34532f8a7899b28d496a
https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/
https://hackerone.com/reports/1178562
https://github.com/ruby/net-imap/commit/adba6f0c3e5c5607c4822b9120322eb7e9a77891
https://security.archlinux.org/CVE-2021-31810
https://security.archlinux.org/CVE-2021-32066

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanyruby<Β 3.0.2-1UNKNOWN

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N