Read the docs
TI-2021-12024 Aliases CVE-2021-32066GHSA-gx49-h5r3-q3xj

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.

Priority LOW 38CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Why it matters now

EPSS 0.02909 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 9 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*2.6.0 – 2.6.7; 2.7.0 – 2.7.3; 3.0.0 – 3.0.1Vulnerableruby
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.6.1VulnerableOracle
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions 2.6.0 – 2.6.7; 2.7.0 – 2.7.3; 3.0.0 – 3.0.1 Vulnerable ·ruby
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.1 Vulnerable ·Oracle

Remediation

Red Hat 9 advisories

  • RHSA-2022:0708 Released 2022-02-28 · Red Hat rating Important
    rh-ruby26-ruby security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
    • Red Hat Software Collections for RHEL(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
  • RHSA-2022:0672 Released 2022-02-24 · Red Hat rating Moderate
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64::ruby:2.5, ruby-2.5.9-109.module+el8.5.0+14275+d9c243ca.i686::ruby:2.5, ruby-2.5.9-109.module+el8.5.0+14275+d9c243ca.ppc64le::ruby:2.5 +47
  • RHSA-2022:0582 Released 2022-02-21 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby-2.6.9-107.module+el8.2.0+14086+86d863af.aarch64::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le::ruby:2.6 +47
Show 6 more Red Hat advisories
  • RHSA-2022:0581 Released 2022-02-21 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src::ruby:2.6 +47
  • RHSA-2022:0544 Released 2022-02-16 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) ruby-2.6.9-108.module+el8.4.0+14070+b3717926.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.i686::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.ppc64le::ruby:2.6 +47
  • RHSA-2022:0543 Released 2022-02-16 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.i686::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.ppc64le::ruby:2.6 +47
  • RHSA-2021:3982 Released 2021-10-25 · Red Hat rating Important
    rh-ruby30-ruby security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby30-ruby-3.0.2-148.el7, rh-ruby30-ruby-default-gems-3.0.2-148.el7, rh-ruby30-ruby-devel-3.0.2-148.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby30-ruby-3.0.2-148.el7, rh-ruby30-ruby-default-gems-3.0.2-148.el7, rh-ruby30-ruby-devel-3.0.2-148.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby30-ruby-3.0.2-148.el7, rh-ruby30-ruby-default-gems-3.0.2-148.el7, rh-ruby30-ruby-devel-3.0.2-148.el7 +18
  • RHSA-2021:3559 Released 2021-09-20 · Red Hat rating Important
    rh-ruby27-ruby security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby27-ruby-2.7.4-130.el7, rh-ruby27-ruby-devel-2.7.4-130.el7, rh-ruby27-ruby-doc-2.7.4-130.el7 +19
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby27-ruby-2.7.4-130.el7, rh-ruby27-ruby-devel-2.7.4-130.el7, rh-ruby27-ruby-doc-2.7.4-130.el7 +19
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby27-ruby-2.7.4-130.el7, rh-ruby27-ruby-devel-2.7.4-130.el7, rh-ruby27-ruby-doc-2.7.4-130.el7 +19
  • RHSA-2021:3020 Released 2021-08-05 · Red Hat rating Important
    ruby:2.7 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64::ruby:2.7, ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.i686::ruby:2.7, ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le::ruby:2.7 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3020, RHSA-2022:0543, RHSA-2022:0672
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:0581
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:0582
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0544
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0708
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0708
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:3559, RHSA-2021:3982
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:3559, RHSA-2021:3982
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:3559, RHSA-2021:3982
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32066
  2. 2026-10-03 Alias added: GHSA-gx49-h5r3-q3xj

References

Exploit 1

Patch 2

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences