NetSight
IP …
high7.4

CVE-2021-32066

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.

Impact

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Affected products

VendorProductAffected versions
Ruby-LangRuby
from 2.6.0 through 2.6.7
from 2.7.0 through 2.7.3
from 3.0.0 through 3.0.1
OracleJd Edwards Enterpriseone Tools
before 9.2.6.1

Weakness classification

CWE-755

References