CVE-2021-32066

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32066
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32066.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32066
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (9)
RHSA (9)
RLSA (3)
SUSE (4)
UBUNTU (1)
Related
ALSA (3)
openSUSE (9)
SUSE (4)
Published
2021-08-01T19:15:07Z
Modified
2026-07-08T05:57:04Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "fixed":  "9.2.6.1"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "oracle:jd_edwards_enterpriseone_tools"
        }
    ]
}
References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type
GIT
Repo
https://github.com/ruby/ruby
Events
Introduced
c1af7b1e1d408f9796a5f46c9ed36bc5adea4aa2
Last Affected
930143880a8b593e7444b94e2e0522b83a25c671
Introduced
647ee6f091eafcce70ffb75ddf7e121e192ab217
Last Affected
6847ee089d7655b2a0eea4fee3133aeacd4cc7cc
Introduced
95aff214687a5e12c3eb57d056665741e734c188
Last Affected
0fb782ee38ea37fd5fe8b1f775f8ad866a82a3f0
Fixed
a21a3b7d23704a01d34bd79d09dc37897e00922a
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.6.0"
        },
        {
            "last_affected":  "2.6.7"
        },
        {
            "introduced":  "2.7.0"
        },
        {
            "last_affected":  "2.7.3"
        },
        {
            "introduced":  "3.0.0"
        },
        {
            "last_affected":  "3.0.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
v2_7_0
v2_7_1
v2_7_2
v2_7_3
v3_0_0
v3_0_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32066.json"