- ----------------------------------------------------------------------
Debian LTS Advisory DLA-2780-1             debian-lts@lists.debian.org
https://www.debian.org/lts/security/                     Utkarsh Gupta
October 11, 2021                           https://wiki.debian.org/LTS
- ----------------------------------------------------------------------

Package        : ruby2.3
Version        : 2.3.3-1+deb9u10
CVE ID         : CVE-2021-31799 CVE-2021-31810 CVE-2021-32066
Debian Bug     : 990815

Multiple vulnerabilites in ruby2.3, interpreter of object-oriented
scripting language Ruby, were discovered.

CVE-2021-31799

    In RDoc 3.11 through 6.x before 6.3.1, as distributed with
    Ruby through 2.3.3, it is possible to execute arbitrary
    code via | and tags in a filename.

CVE-2021-31810

    An issue was discovered in Ruby through 2.3.3. A malicious
    FTP server can use the PASV response to trick Net::FTP into
    connecting back to a given IP address and port. This
    potentially makes curl extract information about services
    that are otherwise private and not disclosed (e.g., the
    attacker can conduct port scans and service banner extractions).

CVE-2021-32066

    An issue was discovered in Ruby through 2.3.3. Net::IMAP does
    not raise an exception when StartTLS fails with an an unknown
    response, which might allow man-in-the-middle attackers to
    bypass the TLS protections by leveraging a network position
    between the client and the registry to block the StartTLS
    command, aka a "StartTLS stripping attack."

For Debian 9 stretch, these problems have been fixed in version
2.3.3-1+deb9u10.

We recommend that you upgrade your ruby2.3 packages.

For the detailed security status of ruby2.3 please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS