Ruby: CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP

[NewsBot]

A new Ruby blog post/announcement has been posted!

A StartTLS stripping vulnerability was discovered in Net::FTP. This vulnerability has been assigned the CVE identifier CVE-2021-32066. We strongly recommend upgrading Ruby.

net-imap is a default gem in Ruby 3.0.1 but it has a packaging issue, so please upgrade Ruby itself.

Details

Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle atta...

Get the full details here: CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP

[bot]

Corresponding tweet for this thread:

Devtalk

Share link for this tweet.