Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2021-32066 — HIGH severity vulnerability | Release Alert

CVE-2021-32066

7.4

HIGHCVSS v3

Published

August 1, 2021

CVSS v2

5.8 MEDIUM

Affected

9 projects

Assigned by

MITRE

Severity scale

010

Description

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Ruby

ChocolateyRuby is a dynamic, open source programming language focusing on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. This package provides a self-contained [Windows-based installer](https://rubyinstaller.org) that includes the Ruby language, an execution environment, important documentation, and more. ## Package Parameters - `/InstallDir` - Ruby installation directory, by default `c:\tools\RubyXY` where XY are major and minor version parts. - `/NoPath` - Do not add ruby bin folder to machine PATH. Example: `choco install ruby --package-parameters="'/NoPath ""/InstallDir:C:\your\install\path""'"` ## Notes - To install ruby development kit ruby installer provides `ridk` command. It provides an easy way to install msys2 via `ridk install 1`, however, the installation is interactive. To accomplish unattended install, use [msys2](https://chocolatey.org/packages/msys2) package.

>= 3.0.0, <= 3.0.1, >= 2.7.0, <= 2.7.3, >= 2.6.0, <= 2.6.7NVD