PT-2021-4038 · Ruby+9 · Ruby+9
Published
2021-04-02
·
Updated
2025-12-12
·
CVE-2021-31810
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Ruby versions prior to 2.6.8
Ruby versions 2.7.x through 2.7.3
Ruby versions 3.x through 3.0.1
Description
The issue is related to the implementation of the Net::FTP class in the Ruby interpreter, which has weaknesses in protecting service data using the PASV command. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port, potentially allowing an attacker to extract information about private services, conduct port scans, and service banner extractions.
Recommendations
For Ruby versions prior to 2.6.8, update to version 2.6.8 or later.
For Ruby versions 2.7.x through 2.7.3, update to version 2.7.4 or later.
For Ruby versions 3.x through 3.0.1, update to version 3.0.2 or later.
As a temporary workaround, consider restricting the use of the
Net::FTP class until a patch is available.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Ruby
Suse
Ubuntu