CVE-2021-32066: High severity ruby-lang Ruby vulnerability
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Other sources
Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.”
References:
https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/
— Red Hat
Ruby's Net::IMAP module did not raise an exception when receiving an unexpected response to the STARTTLS command and the connection was not upgraded to use TLS. A man-in-the-middle attacker could use this flaw to prevent Ruby applications using Net::IMAP to enable TLS encryption for a connection to an IMAP server and subsequently eavesdrop on or modify data sent over the plain text connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-ruby27-rubyto a version that resolves this vulnerability.Fixed in 0:2.7.4-130.el7 - Upgrade
Upgrade
redhat/rh-ruby30-rubyto a version that resolves this vulnerability.Fixed in 0:3.0.2-148.el7 - Upgrade
Upgrade
redhat/rh-ruby26-rubyto a version that resolves this vulnerability.Fixed in 0:2.6.9-120.el7 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 2.6.8 - Upgrade
Upgrade
redhat/rubygem-net-imapto a version that resolves this vulnerability.Fixed in 0.2.2 - Upgrade
Upgrade
debian/jrubyto a version that resolves this vulnerability.Fixed in 9.3.9.0+ds-8Fixed in 9.4.8.0+ds-3Fixed in 10.1.2.0+ds-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-32066.
What is the severity of CVE-2021-32066?
The severity of CVE-2021-32066 is high with a CVSS score of 7.4.
Which software versions are affected by CVE-2021-32066?
Ruby versions through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1 are affected by CVE-2021-32066.
How can a man-in-the-middle attacker exploit CVE-2021-32066?
A man-in-the-middle attacker can exploit CVE-2021-32066 by using it to prevent Ruby applications using Net::IMAP from enabling TLS encryption for a connection.
Where can I find more information about CVE-2021-32066?
You can find more information about CVE-2021-32066 on the CVE website, NVD, Ruby's official website, and the Red Hat Bugzilla and Errata pages.