VulnerableCode Package Details - pkg:deb/ubuntu/ruby2.5@2.5.1-1ubuntu1.9

Search for packages

Vulnerability	Summary	Fixed by
VCID-4qeb-7mva-aaak Aliases: CVE-2021-32066	An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."	2.5.1-1ubuntu1.10 Affected by 0 other vulnerabilities.
VCID-gmf4-gcd5-aaab Aliases: CVE-2021-31799 GHSA-ggxm-pgc9-g7fp	In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via \| and tags in a filename.	2.5.1-1ubuntu1.10 Affected by 0 other vulnerabilities.
VCID-xv5b-y3av-aaae Aliases: CVE-2021-31810	An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).	2.5.1-1ubuntu1.10 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-4qeb-7mva-aaak
Aliases:
CVE-2021-32066

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

2.5.1-1ubuntu1.10
Affected by 0 other vulnerabilities.

VCID-gmf4-gcd5-aaab
Aliases:
CVE-2021-31799
GHSA-ggxm-pgc9-g7fp

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

2.5.1-1ubuntu1.10
Affected by 0 other vulnerabilities.

VCID-xv5b-y3av-aaae
Aliases:
CVE-2021-31810

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).

2.5.1-1ubuntu1.10
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-nw56-rqyq-aaaq	The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.	CVE-2021-28965 GHSA-8cr8-4vfw-mr7h

Vulnerability

Summary

Aliases

VCID-nw56-rqyq-aaaq

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

CVE-2021-28965
GHSA-8cr8-4vfw-mr7h

Next non-vulnerable version	2.5.1-1ubuntu1.10
Latest non-vulnerable version	2.5.5-4ubuntu2.1
Risk	4.0