CVE-2021-31810
mediumPriorität · verfolgen · 24EPSS 0.030 · 87. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (43)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2022-1305Ruby: Mehrere SchwachstellenDeutsch2021-07-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.
- BIT-ruby-2021-318102024-03-06vendor · osvUS
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
- BIT-ruby-min-2021-318102025-01-27vendor · osvUS
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202107-409cnnvd
- EUVD-2021-18688enisa_euvd
- BDU:2021-04565fstec_bdu
- GHSA-wr95-679j-87v9enisa_euvd
- BIT-ruby-2021-31810osv
- BIT-ruby-min-2021-31810osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (53)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2021-31810cnnvd
- https://hackerone.com/reports/1145454cnnvd
- https://lists.debian.org/debian-lts-announce/2021/10/msg00009.htmlcnnvd
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/cnnvd
- https://packetstormsecurity.com/files/163622/Ubuntu-Security-Notice-USN-5020-1.htmlcnnvd
- https://packetstormsecurity.com/files/163745/Red-Hat-Security-Advisory-2021-3020-01.htmlcnnvd
- https://packetstormsecurity.com/files/164211/Red-Hat-Security-Advisory-2021-3559-01.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan