CVE catalog

CVE-2021-32066

jruby: CVE-2021-32066

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.91% · Oct 25, 2026

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjrubysid10.1.2.0+ds-1fixed
Debianjrubyforky10.1.2.0+ds-1fixed
Debianjrubytrixie9.4.8.0+ds-3fixed
Debianjrubybookworm9.3.9.0+ds-8fixed
Alpineruby3.112.6.8-r0fixed
Alpineruby3.122.7.4-r0fixed
Alpineruby3.132.7.4-r0fixed
Alpineruby3.142.7.4-r0fixed
Alpineruby3.152.7.4-r0fixed
Alpineruby3.162.7.4-r0fixed
Alpineruby3.172.7.4-r0fixed
Alpineruby3.182.7.4-r0fixed
Alpineruby3.192.7.4-r0fixed
Alpineruby3.202.7.4-r0fixed
Alpineruby3.212.7.4-r0fixed
Alpineruby3.222.7.4-r0fixed
Alpineruby3.232.7.4-r0fixed
Alpineruby3.242.7.4-r0fixed
Ubunturuby2.3pro2.3.0-1vulnerable
Ubunturuby2.3pro2.3.0-2vulnerable
Ubunturuby2.3pro2.3.0-4ubuntu2vulnerable
Ubunturuby2.3pro2.3.0-4ubuntu3vulnerable
Ubunturuby2.3pro2.3.0-5ubuntu1vulnerable
Ubunturuby2.3pro2.3.1-2~16.04vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.2vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.4vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.5vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.6vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.7vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.9vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.10vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.11vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.12vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.13vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.14vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.15vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm1fixed
Ubunturuby2.518.042.5.0~preview1-1ubuntu2vulnerable
Ubunturuby2.518.042.5.0-4ubuntu1vulnerable
Ubunturuby2.518.042.5.0-4ubuntu4vulnerable
Ubunturuby2.518.042.5.0-5ubuntu1vulnerable
Ubunturuby2.518.042.5.0-6ubuntu1vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.1vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.2vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.4vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.5vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.6vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.7vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.8vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.9vulnerable
Ubunturuby2.518.042.5.1-1ubuntu1.10fixed
Ubunturuby2.720.042.7.0-1vulnerable
Ubunturuby2.720.042.7.0-2vulnerable
Ubunturuby2.720.042.7.0-3vulnerable
Ubunturuby2.720.042.7.0-4vulnerable
Ubunturuby2.720.042.7.0-4ubuntu1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.2vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.3vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.4vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjrubysourcesid9.3.9.0+ds-1not yet assignedNot reported[1014818]
Debianjrubysourceforky9.3.9.0+ds-1not yet assignedNot reported[1014818]
Debianjrubysourcetrixie9.3.9.0+ds-1not yet assignedNot reported[1014818]
Debianjrubysourcebookworm9.3.9.0+ds-1not yet assignedNot reported[1014818]
Alpinerubyapk3.112.6.8-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.122.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.132.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.142.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.152.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.162.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.172.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.182.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.192.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.202.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.212.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.222.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.232.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Alpinerubyapk3.242.7.4-r0Not reportedALPINE-CVE-2021-32066Not reported
Ubunturuby2.3debpro2.3.1-2~ubuntu16.04.16+esm1Not reportedUBUNTU-CVE-2021-32066Not reported
Ubunturuby2.5deb18.042.5.1-1ubuntu1.10Not reportedUBUNTU-CVE-2021-32066Not reported
Ubunturuby2.7deb20.042.7.0-5ubuntu1.5Not reportedUBUNTU-CVE-2021-32066Not reported

[Debian bug #1014818]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jruby]Fixed
    Details (2)

    • 9.3.9.0+ds-8 · all · bookworm

      Fixed · Fixed: 9.3.9.0+ds-1

      dsa · jruby · debian · bookworm; dsa · jruby · debian · 12

    • 9.3.9.0+ds-8 · all · bookworm

      Fixed · Fixed: 9.3.9.0+ds-1

      dsa · jruby · debian · bookworm; dsa · jruby · debian · 12

[Debian 13 (Trixie)]

  • [jruby]Fixed
    Details (2)

    • 9.4.8.0+ds-3 · all · trixie

      Fixed · Fixed: 9.3.9.0+ds-1

      dsa · jruby · debian · 13

    • 9.4.8.0+ds-3 · all · trixie

      Fixed · Fixed: 9.3.9.0+ds-1

      dsa · jruby · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]