An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
References
| Link | Resource |
|---|---|
| https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ | Vendor Advisory |
| https://hackerone.com/reports/1145454 | Exploit Patch Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210917-0001/ | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html | Mailing List Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/ | |
| https://security.gentoo.org/glsa/202401-27 |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
24 Jan 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Nov 2023, 03:35
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
30 Apr 2023, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2021-07-13 13:15
Updated : 2024-01-24 05:15
NVD link : CVE-2021-31810
Mitre link : CVE-2021-31810
JSON object : View
Products Affected
debian
- debian_linux
ruby-lang
- ruby
oracle
- jd_edwards_enterpriseone_tools
fedoraproject
- fedora
CWE