ArchLinux: 202107-25: ruby2.6: multiple issues | LinuxSecurity.com

Advisories

Arch Linux Security Advisory ASA-202107-25
==========================================

Severity: High
Date    : 2021-07-14
CVE-ID  : CVE-2021-31799 CVE-2021-31810 CVE-2021-32066
Package : ruby2.6
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2140

Summary
=======

The package ruby2.6 before version 2.6.8-1 is vulnerable to multiple
issues including silent downgrade, arbitrary command execution and
information disclosure.

Resolution
==========

Upgrade to 2.6.8-1.

# pacman -Syu "ruby2.6>=2.6.8-1"

The problems have been fixed upstream in version 2.6.8.

Workaround
==========

None.

Description
===========

- CVE-2021-31799 (arbitrary command execution)

RDoc before version 6.3.1, as bundled with Ruby before version 2.7.4
and 2.6.8 as well as GitLab before version 14.0.2, used to call
Kernel#open to open a local file. If a Ruby project has a file whose
name starts with "|" and ends with "tags", the command following the
pipe character is executed. A malicious Ruby project could exploit it
to run an arbitrary command execution against a user who attempts to
run the rdoc command.

- CVE-2021-31810 (information disclosure)

A security issue has been discovered in Ruby before versions 3.0.2,
2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to
trick Net::FTP into connecting back to a given IP address and port.
This potentially makes Net::FTP extract information about services that
are otherwise private and not disclosed (e.g., the attacker can conduct
port scans and service banner extractions).

- CVE-2021-32066 (silent downgrade)

A security issue has been discovered in Ruby before versions 3.0.2,
2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS
fails with an unknown response, which might allow man-in-the-middle
attackers to bypass the TLS protections by leveraging a network
position between the client and the registry to block the StartTLS
command, aka a “StartTLS stripping attack”.

Impact
======

A remote man-in-the-middle attacker could strip StartTLS encryption
from IMAP connections to disclose authentication credentials and
emails. Furthermore, a malicious FTP server could induce connections to
an arbitrary IP address and port on a client, leading to potential
information disclosure.

References
==========

https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7
https://github.com/ruby/ruby/commit/483f303d02e768b69e476e0b9be4ab2f26389522
https://github.com/ruby/ruby/commit/fe3c49c9baeeab58304ede915b7edd18ecf360fc
https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/
https://hackerone.com/reports/1145454
https://github.com/ruby/net-ftp/commit/5709ece67cf57a94655e34532f8a7899b28d496a
https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/
https://hackerone.com/reports/1178562
https://github.com/ruby/net-imap/commit/adba6f0c3e5c5607c4822b9120322eb7e9a77891
https://security.archlinux.org/CVE-2021-31799
https://security.archlinux.org/CVE-2021-31810
https://security.archlinux.org/CVE-2021-32066

ArchLinux: 202107-25: ruby2.6: multiple issues

July 16, 2021
The package ruby2.6 before version 2.6.8-1 is vulnerable to multiple issues including silent downgrade, arbitrary command execution and information disclosure

Summary

- CVE-2021-31799 (arbitrary command execution)
RDoc before version 6.3.1, as bundled with Ruby before version 2.7.4 and 2.6.8 as well as GitLab before version 14.0.2, used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with "|" and ends with "tags", the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command.
- CVE-2021-31810 (information disclosure)
A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
- CVE-2021-32066 (silent downgrade)
A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack”.

Resolution

Upgrade to 2.6.8-1.
# pacman -Syu "ruby2.6>=2.6.8-1"
The problems have been fixed upstream in version 2.6.8.

References

https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/ https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7 https://github.com/ruby/ruby/commit/483f303d02e768b69e476e0b9be4ab2f26389522 https://github.com/ruby/ruby/commit/fe3c49c9baeeab58304ede915b7edd18ecf360fc https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ https://hackerone.com/reports/1145454 https://github.com/ruby/net-ftp/commit/5709ece67cf57a94655e34532f8a7899b28d496a https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ https://hackerone.com/reports/1178562 https://github.com/ruby/net-imap/commit/adba6f0c3e5c5607c4822b9120322eb7e9a77891 https://security.archlinux.org/CVE-2021-31799 https://security.archlinux.org/CVE-2021-31810 https://security.archlinux.org/CVE-2021-32066

Severity
CVE-ID : CVE-2021-31799 CVE-2021-31810 CVE-2021-32066
Package : ruby2.6
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2140

Impact

A remote man-in-the-middle attacker could strip StartTLS encryption from IMAP connections to disclose authentication credentials and emails. Furthermore, a malicious FTP server could induce connections to an arbitrary IP address and port on a client, leading to potential information disclosure.

Workaround

None.

Related News

© 2022 Guardian Digital, Inc All Rights Reserved

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.