DEBIAN-CVE-2021-32066

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2021-32066
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-32066.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2021-32066
Upstream
Published
2021-08-01T19:15:07Z
Modified
2025-09-25T02:34:10.401592Z
Summary
[none]
Details

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

References

Affected packages

Debian:12 / jruby

Package

Name
jruby
Purl
pkg:deb/debian/jruby?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.3.9.0+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / jruby

Package

Name
jruby
Purl
pkg:deb/debian/jruby?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.3.9.0+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / jruby

Package

Name
jruby
Purl
pkg:deb/debian/jruby?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.3.9.0+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:11 / ruby2.7

Package

Name
ruby2.7
Purl
pkg:deb/debian/ruby2.7?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}