Man In The Middle (MitM)

🗓️ 10 Jul 2021 14:45:44Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 38 Views

ruby2.7 vulnerable to StartTLS stripping attac

Reporter	Title	Published	Views	Family All 213
FreeBSD	Ruby -- multiple vulnerabilities	7 Jul 202100:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : ruby (ALAS-2024-2570)	12 Jun 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : ruby (ALASRUBY2.6-2023-004)	27 Sep 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : ruby (ALASRUBY3.0-2023-005)	27 Sep 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0054: ruby:2.7 (ALINUX3-SA-2021:0054)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:2.6 (ALSA-2022:0543)	11 Mar 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:2.5 (ALSA-2022:0672)	11 Mar 202200:00	–	nessus
Tenable Nessus	CentOS 8 : ruby:2.7 (CESA-2021:3020)	9 Aug 202100:00	–	nessus
Tenable Nessus	CentOS 8 : ruby:2.6 (CESA-2022:0543)	16 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : ruby:2.5 (CESA-2022:0672)	25 Feb 202200:00	–	nessus

Vulners

Node

ruby2.7 ruby2.7Match2.7.2-3debian

AND

debian debian_linuxMatch999

ruby2.7 ruby2.7Match2.7.2-3debian

AND

debian debian_linuxMatch11

ruby rubyMatch2.7.3-r1os

AND

ruby rubyMatch2.7.3-r0os

AND

ruby rubyMatch2.6.6-r2os

AND

ruby rubyMatch2.6.5-r2os

AND

ruby rubyMatch2.7.1-r3os

AND

ruby rubyMatch2.7.2-r4os

AND

ruby rubyMatch2.6.6-r4os

AND

ruby rubyMatch2.7.2-r3os

AND

alpinelinux alpine_linuxMatchedge

ruby rubyMatch2.7.3-r1os

AND

alpinelinux alpine_linuxMatch3.14

ruby rubyMatch2.7.2-r1os

AND

ruby rubyMatch2.7.1-r3os

AND

ruby rubyMatch2.7.3-r0os

AND

ruby rubyMatch2.7.2-r0os

AND

alpinelinux alpine_linuxMatch3.12

ruby rubyMatch2.7.2-r3os

AND

ruby rubyMatch2.7.2-r4os

AND

ruby rubyMatch2.7.3-r0os

AND

alpinelinux alpine_linuxMatch3.13

ruby rubyMatch2.6.7-r0os

AND

ruby rubyMatch2.6.6-r3os

AND

ruby rubyMatch2.6.6-r2os

AND

alpinelinux alpine_linuxMatch3.11

devel develMatch2.7.2-3debian

AND

devel develMatch2.7.2-4debian

AND

devel develMatch2.7.1-3build1debian

AND

devel develMatch2.7.1-3debian

AND

debian debian_linux

focal focalMatch2.7.0-5ubuntu1debian

AND

focal focalMatch2.7.0-5ubuntu1.1debian

AND

focal focalMatch2.7.0-5ubuntu1.2debian

AND

debian debian_linux

hirsute hirsuteMatch2.7.2-3debian

AND

debian debian_linux

google bionicMatch2.5.1-1ubuntu1.6debian

AND

google bionicMatch2.5.1-1ubuntu1debian

AND

google bionicMatch2.5.1-1ubuntu1.7debian

AND

debian debian_linux

apache groovyMatch2.7.1-3ubuntu1debian

AND

apache groovyMatch2.7.1-3ubuntu1.1debian

AND

apache groovyMatch2.7.1-3build1debian

AND

debian debian_linux

ruby2.3 ruby2.3Match2.3.3-1+deb9u8debian

AND

debian debian_linuxMatch9

ruby2.5 ruby2.5Match2.5.5-3+deb10u3debian

AND

ruby2.5 ruby2.5Match2.5.5-3+deb10u2debian

AND

debian debian_linuxMatch10

jruby jrubyMatch9.1.17.0-3debian

AND

debian debian_linuxMatch999

rh-ruby26-ruby rh-ruby26-rubyMatch2.6.2_118.el7

ruby rubyMatch2.4.5_90.el7cf

ruby rubyMatch2.0.0.648_35.el7_6

ruby rubyMatch2.0.0.598_25.ael7b_1

ruby rubyMatch2.0.0.648_36.el7

ruby rubyMatch2.0.0.648_34.el7_6

ruby rubyMatch2.4.6_91.el7cf

ruby rubyMatch2.4.9_93.el7cf

ruby rubyMatch2.0.0.648_39.el7_9

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2021/10/msg00009.html
lists	www.lists.debian.org/debian-lts-announce/2023/04/msg00033.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-32066
security	www.security.gentoo.org/glsa/202401-27
github	www.github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a
hackerone	www.hackerone.com/reports/1178562
security	www.security.netapp.com/advisory/ntap-20210902-0004/
oracle	www.oracle.com/security-alerts/cpuapr2022.html
ruby-lang	www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/

24 Jan 2024 06:21Current

2.9Low risk

Vulners AI Score2.9

CVSS 25.8

CVSS 3.17.4

EPSS0.00074