Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-32066: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ruby | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | ruby-debuginfo | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | ruby-devel | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | ruby-doc | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | ruby-irb | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | ruby-libs | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | ruby-tcltk | 0:2.0.0.648-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-bigdecimal | 0:1.2.0-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-io-console | 0:0.4.2-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-json | 0:1.7.7-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-minitest | 0:4.3.2-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-psych | 0:2.0.0-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-rake | 0:0.9.6-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygem-rdoc | 0:4.0.0-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygems | 0:2.0.14.1-36.amzn2.0.10 |
| Amazon Linux · 2 | rubygems-devel | 0:2.0.14.1-36.amzn2.0.10 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-32066.html