CVE-2021-32066 is a vulnerability in Ruby's Net::IMAP library (versions through 2.6.7, 2.7.3, and 3.0.1) that allows a man-in-the-middle attacker to bypass StartTLS protections. The library fails to raise an exception when StartTLS encounters an unknown response, enabling a "StartTLS stripping attack." This high-severity vulnerability (CVSS 7.4) has a network attack vector and high impact on confidentiality and integrity, but requires high attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.0, <= 2.6.7CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
>= 2.7.0, <= 2.7.3CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
>= 3.0.0, <= 3.0.1CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
< 9.2.6.1CPE matchmatch criteria | cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
An issue was discovered in Ruby through 2.6.7 2.7.x through 2.7.3 and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command aka a "StartTLS stripping attack."
Aug 10, 2021ruby: StartTLS stripping vulnerability in Net::IMAP
Jul 7, 2021