CVE-2021-31810

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from systems not accessible from the FTP server.

Red Hat CloudForms 5.11 does not ship Ruby or RubyGem net-ftp and thus not affected by the flaw. RubyGem net-sftp (Ruby implementation of Secure File Transfer Protocol) which product ship is different library component from the affected package.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.