CVE-2021-32066: High severity ruby vulnerability
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Other sources
Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.”
References:
https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/
— Red Hat
Ruby's Net::IMAP module did not raise an exception when receiving an unexpected response to the STARTTLS command and the connection was not upgraded to use TLS. A man-in-the-middle attacker could use this flaw to prevent Ruby applications using Net::IMAP to enable TLS encryption for a connection to an IMAP server and subsequently eavesdrop on or modify data sent over the plain text connection.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-32066.
What is the severity of CVE-2021-32066?
The severity of CVE-2021-32066 is high with a CVSS score of 7.4.
Which software versions are affected by CVE-2021-32066?
Ruby versions through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1 are affected by CVE-2021-32066.
How can a man-in-the-middle attacker exploit CVE-2021-32066?
A man-in-the-middle attacker can exploit CVE-2021-32066 by using it to prevent Ruby applications using Net::IMAP from enabling TLS encryption for a connection.
Where can I find more information about CVE-2021-32066?
You can find more information about CVE-2021-32066 on the CVE website, NVD, Ruby's official website, and the Red Hat Bugzilla and Errata pages.