CVE-2021-31810

Katalog CVE

CVSS 5.8 · Medium EPSS 3,1%

Kerentanan pada ruby-lang ruby, debian linux +1 lainnya. Skor CVSS 3.1 5.8 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).

Rincian

Terbit di NVD

13 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

3,1% peluang dieksploitasi; lebih tinggi dari 87,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ advisory vendor
• https://hackerone.com/reports/1145454 exploit · patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210917-0001/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF...
• https://security.gentoo.org/glsa/202401-27