CVE-2021-31810

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).

References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type

GIT

Repo

https://github.com/ruby/ruby

Events

Introduced

Last affected

930143880a8b593e7444b94e2e0522b83a25c671

Introduced

647ee6f091eafcce70ffb75ddf7e121e192ab217

Last affected

6847ee089d7655b2a0eea4fee3133aeacd4cc7cc

Introduced

95aff214687a5e12c3eb57d056665741e734c188

Last affected

0fb782ee38ea37fd5fe8b1f775f8ad866a82a3f0

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6.7"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.3"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.1"
        }
    ]
}

Affected versions

Other

v2_7_0

v2_7_1

v2_7_2

v2_7_3

v3_0_0

v3_0_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31810.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "9.2.6.1"
            }
        ]
    }
]