Vulnerability Description
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ruby-Lang | Ruby | <= 2.6.7 |
| Fedoraproject | Fedora | 34 |
| Debian | Debian Linux | 9.0 |
| Oracle | Jd Edwards Enterpriseone Tools | < 9.2.6.1 |
References
- https://hackerone.com/reports/1145454ExploitPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/10/msg00009.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20210917-0001/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/Vendor Advisory
- https://hackerone.com/reports/1145454ExploitPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/10/msg00009.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20210917-0001/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2021-31810?
CVE-2021-31810 is a vulnerability with a CVSS score of 5.8 (MEDIUM). An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address...
How severe is CVE-2021-31810?
CVE-2021-31810 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-31810?
Check the references section above for vendor advisories and patch information. Affected products include: Ruby-Lang Ruby, Fedoraproject Fedora, Debian Debian Linux, Oracle Jd Edwards Enterpriseone Tools.