Skip to content

Commit 2448578

Browse files
flavorjonesRubySec CI
flavorjones
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@1029304 
1 parent 9fea94e commit 2448578

5 files changed

Lines changed: 449 additions & 0 deletions

File tree

‎advisories/_posts/2026-05-04-CVE-2026-42245.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42245 (net-imap): net-imap has quadratic complexity when reading
4+
response literals'
5+
comments: false
6+
categories:
7+
- net-imap
8+
advisory:
9+
gem: net-imap
10+
cve: 2026-42245
11+
ghsa: q2mw-fvj9-vvcw
12+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
13+
title: net-imap has quadratic complexity when reading response literals
14+
date: 2026-05-04
15+
description: |-
16+
### Summary
17+
18+
`Net::IMAP::ResponseReader` has quadratic time complexity when reading large
19+
responses containing many string literals. A hostile server can send
20+
responses which are crafted to exhaust the client's CPU for a denial of
21+
service attack.
22+
23+
### Details
24+
25+
For each literal in a response, `ResponseReader` rescans the entire growing
26+
response buffer. The regular expression that is used to scan the response
27+
buffer runs in linear time. With many literals, this becomes O(n²) total
28+
work. The regular expression should run in constant time: it is anchored to
29+
the end and only the last 23 bytes of the buffer are relevant.
30+
31+
Because the algorithmic complexity is super-linear, this bypasses protection
32+
from `max_response_size`: a response can stay well below the default size
33+
limit while still causing very large CPU cost.
34+
35+
`Net::IMAP::ResponseReader` runs continuously in the receiver thread until the
36+
connection closes.
37+
38+
### Impact
39+
40+
This consumes disproportionate CPU time in the client's receiver thread. A
41+
hostile server could use this to exhaust the client's CPU for a denial of
42+
service attack.
43+
44+
For a response near the default `max_response_size`, each individual regexp
45+
scan could take between 100 to 200ms on common modern hardware, and this may
46+
be repeated 200k times per megabyte of response. While the regexp is
47+
scanning, it retains the Global VM lock, preventing other threads from
48+
running.
49+
50+
Although other threads should not be _completely_ blocked, their run time will
51+
be significantly impacted.
52+
53+
### Mitigation
54+
* Upgrade to a patched version of net-imap that reads responses more efficiently.
55+
* Do not connect to untrusted IMAP servers.
56+
* When connecting to untrusted servers, a _much_ smaller `max_response_size`
57+
(for example: 8KiB) will limit the impact. Although this is too small for
58+
fetching unpaginated message bodies, it should be enough for most other
59+
operations.
60+
cvss_v4: 2.3
61+
patched_versions:
62+
- "~> 0.4.24"
63+
- "~> 0.5.14"
64+
- ">= 0.6.4"
65+
related:
66+
url:
67+
- https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
68+
- https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96
69+
- https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda
70+
- https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819
71+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
72+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
73+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
74+
- https://github.com/advisories/GHSA-q2mw-fvj9-vvcw
75+
---

‎advisories/_posts/2026-05-04-CVE-2026-42246.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42246 (net-imap): net-imap vulnerable to STARTTLS stripping via invalid
4+
response timing'
5+
comments: false
6+
categories:
7+
- net-imap
8+
advisory:
9+
gem: net-imap
10+
cve: 2026-42246
11+
ghsa: vcgp-9326-pqcp
12+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
13+
title: net-imap vulnerable to STARTTLS stripping via invalid response timing
14+
date: 2026-05-04
15+
description: |-
16+
### Summary
17+
18+
A man-in-the-middle attacker can cause `Net::IMAP#starttls` to return
19+
"successfully", without starting TLS.
20+
21+
### Details
22+
23+
When using `Net::IMAP#starttls` to upgrade a plaintext connection to use TLS,
24+
a man-in-the-middle attacker can inject a tagged `OK` response with an easily
25+
predictable tag. By sending the response before the client finishes sending
26+
the command, the command completes "successfully" before the response handler
27+
is registered. This allows `#starttls` to return without error, but the
28+
response handler is never invoked, the TLS connection is never established,
29+
and the socket remains unencrypted.
30+
31+
This allows man-in-the-middle attackers to perform a STARTTLS stripping
32+
attack, unless the client code explicitly checks `Net::IMAP#tls_verified?`.
33+
34+
### Impact
35+
36+
TLS bypass, leading to cleartext transmission of sensitive information.
37+
38+
### Mitigation
39+
40+
* Upgrade to a patched version of net-imap that raises an exception whenever
41+
`#starttls` does not establish TLS.
42+
* Connect to an implicit TLS port, rather than use `STARTTLS` with a cleartext
43+
port.
44+
This is strongly recommended anyway:
45+
* [RFC 8314](https://www.rfc-editor.org/info/rfc8314): Cleartext Considered
46+
Obsolete: Use of Transport Layer Security (TLS) for Email Submission and
47+
Access
48+
* [NO STARTTLS](https://nostarttls.secvuln.info/): Why TLS is better without
49+
STARTTLS, A Security Analysis of STARTTLS in the Email Context
50+
* Explicitly verify `Net::IMAP#tls_verified?` is `true`, before using the
51+
connection after `#starttls`.
52+
cvss_v4: 7.6
53+
patched_versions:
54+
- "~> 0.3.10"
55+
- "~> 0.4.24"
56+
- "~> 0.5.14"
57+
- ">= 0.6.4"
58+
related:
59+
url:
60+
- https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
61+
- https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
62+
- https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
63+
- https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
64+
- https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
65+
- https://github.com/ruby/net-imap/releases/tag/v0.3.10
66+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
67+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
68+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
69+
- https://nostarttls.secvuln.info
70+
- https://www.rfc-editor.org/info/rfc8314
71+
- https://github.com/advisories/GHSA-vcgp-9326-pqcp
72+
---

‎advisories/_posts/2026-05-04-CVE-2026-42256.md‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42256 (net-imap): net-imap vulnerable to denial of service via high
4+
iteration count for `SCRAM-*` authentication'
5+
comments: false
6+
categories:
7+
- net-imap
8+
advisory:
9+
gem: net-imap
10+
cve: 2026-42256
11+
ghsa: 87pf-fpwv-p7m7
12+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
13+
title: net-imap vulnerable to denial of service via high iteration count for `SCRAM-*`
14+
authentication
15+
date: 2026-05-04
16+
description: |-
17+
### Summary
18+
19+
When authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a
20+
hostile server can perform a computational denial-of-service attack on the
21+
client process by sending a big iteration count value.
22+
23+
### Details
24+
25+
A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in
26+
the SCRAM server-first-message, causing the client to perform an expensive
27+
`OpenSSL::KDF.pbkdf2_hmac` call. Because the PBKDF2 function is a blocking C
28+
extension and holds onto Ruby’s Global VM Lock, it can freeze the entire Ruby
29+
VM for the duration of the computation.
30+
31+
OpenSSL enforces an effective maximum by using a 32-bit signed integer for the
32+
iteration count, Depending on hardware capabilities and OpenSSL version, this
33+
iteration count may be sufficient for to block all Ruby threads in the process
34+
for over seven minutes.
35+
36+
This is listed as one of the \"Security Considerations\", in [RFC
37+
7804](https://www.rfc-editor.org/rfc/rfc7804.html#page-15):
38+
39+
> A hostile server can perform a computational denial-of-service attack on
40+
> clients by sending a big iteration count value. In order to defend against
41+
> that, a client implementation can pick a maximum iteration count that it is
42+
> willing to use and reject any values that exceed that threshold (in such
43+
> cases, the client, of course, has to fail the authentication).
44+
45+
### Impact
46+
47+
During SCRAM authentication to a hostile server, the entire Ruby VM will be
48+
locked for the duration of the computation. Depending on hardware
49+
capabilities and OpenSSL version, this may take many minutes.
50+
51+
`OpenSSL::KDF.pbkdf2_hmac` is a blocking C function, so `Timeout` cannot be
52+
used to guard against this. And it retains the Global VM lock, so other ruby
53+
threads will also be unable to run.
54+
55+
### Mitigation
56+
57+
* Upgrade to a patched version of `net-imap` that adds the `max_iterations`
58+
option to the `SASL-*` authenticators, and call `Net::IMAP#authenticate`
59+
with a `max_iterations` keyword argument.
60+
61+
**NOTE:** The default `max_iterations` is `2³¹ - 1`, the maximum signed 32
62+
bit integer, the maximum allowed by OpenSSL.
63+
64+
_To prevent a denial of service attack,_ this must be set to a safe value,
65+
depending on hardware and version of OpenSSL. _It is the user's
66+
responsibility_ to enforce minimum and maximum iteration counts that are
67+
appropriate for their security context.
68+
69+
* Alternatively, avoid `SCRAM-*` mechanisms when authenticating to untrusted
70+
servers.
71+
cvss_v4: 6.0
72+
unaffected_versions:
73+
- "< 0.4.0"
74+
patched_versions:
75+
- "~> 0.4.24"
76+
- "~> 0.5.14"
77+
- ">= 0.6.4"
78+
related:
79+
url:
80+
- https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
81+
- https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612
82+
- https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4
83+
- https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758
84+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
85+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
86+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
87+
- https://www.rfc-editor.org/rfc/rfc7804.html#page-15
88+
- https://github.com/advisories/GHSA-87pf-fpwv-p7m7
89+
---

‎advisories/_posts/2026-05-04-CVE-2026-42257.md‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42257 (net-imap): net-imap vulnerable to command Injection via "raw"
4+
arguments to multiple commands'
5+
comments: false
6+
categories:
7+
- net-imap
8+
advisory:
9+
gem: net-imap
10+
cve: 2026-42257
11+
ghsa: hm49-wcqc-g2xg
12+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
13+
title: net-imap vulnerable to command Injection via "raw" arguments to multiple
14+
commands
15+
date: 2026-05-04
16+
description: |-
17+
### Summary
18+
19+
Several `Net::IMAP` commands accept a raw string argument that is sent to the
20+
server without validation or escaping. If this string is derived from
21+
user-controlled input, it may contain contain `CRLF` sequences, which an
22+
attacker can use to inject arbitrary IMAP commands.
23+
24+
### Details
25+
26+
`Net::IMAP`'s generic argument handling, used by most command arguments,
27+
interprets string arguments as an IMAP `astring`. Depending on the string
28+
contents and the connection's UTF-8 support, this encodes strings as either a
29+
`atom`, `quoted`, or `literal`. These are safe from command or argument
30+
injection.
31+
32+
But the following commands transform specific String arguments to
33+
`Net::IMAP::RawData`, which bypasses normal argument validation and encoding
34+
and prints the string directly to the socket:
35+
36+
* `#uid_search`, `#search`
37+
* when `criteria` is a String, it is sent raw
38+
* `#uid_fetch`, `#fetch`
39+
* when `attr` is a String, it is sent raw
40+
* when `attr` is an Array, each String in `attr` is sent raw
41+
* `#uid_store`, `#store`
42+
* when `attr` is a String, it is sent raw
43+
* `#setquota`:
44+
* `limit` is interpolated with `#to_s` and that string is sent raw
45+
46+
Because these string arguments are sent without any neutralization, they serve
47+
as a direct vector for command splitting. Any user controlled data
48+
interpolated into these strings can be used to break out of the intended
49+
command context.
50+
51+
Using "raw data" arguments for `#uid_store`, `#store`, and `#setquota` I both
52+
inappropriate and unnecessary. `Net::IMAP`'s generic argument handling is
53+
sufficient to safely validate and encode their arguments. Users of the
54+
library probably do not expect arguments to these commands to be sent raw and
55+
might not be wary of passing unvalidated input.
56+
57+
The API for search criteria and fetch attributes is intentionally low-level
58+
and "close to the wire". It allows developers to use some IMAP extensions
59+
without requiring explicit support from the library and allows developers to
60+
use complex IMAP grammar without complex argument translation. Even so, basic
61+
validation is appropriate and could neutralize command injection.
62+
63+
Although this was explicitly documented for search `criteria`, it was
64+
insufficiently documented for fetch `attr`. So developers may not have
65+
realized that the `attr` argument to `#fetch` and `#uid_fetch` is sent as "raw
66+
data".
67+
68+
### Impact
69+
70+
If a developer passes an unvalidated user-controlled input for one of these
71+
method arguments, an attacker can append CRLF sequence followed by a new IMAP
72+
command (like DELETE mailbox). Although this does not _directly_ enable data
73+
exfiltration, it could be combined with other attack vectors or knowledge of
74+
the target system's attributes, e.g.: shared mail folders or the application's
75+
installed response handlers.
76+
77+
The SEARCH, STORE, and FETCH commands, and their UID variants are some of the
78+
most commonly used features of the library. Applications that build search
79+
queries or fetch attributes dynamically based on user input (e.g., mail
80+
clients or archival tools) may be at significant risk.
81+
82+
Expected use of `Net::IMAP#setquota` is much more limited: `SETQUOTA` is often
83+
only usable by users with special administrative privileges. Depending on the
84+
server, quota administration might be managed through server configuration
85+
rather than via the IMAP protocol `SETQUOTA` command. It is expected to be
86+
uncommonly used in system administration scripts or in interactive sessions,
87+
it should be completely controlled by trusted users, and should only use
88+
trusted inputs. Calling `#setquota` with untrusted user input is expected to
89+
be a very uncommon use case. Please note however this might be combined with
90+
other attacks, for example CSRF, which provide unauthorized access to trusted
91+
inputs, and may specifically target users or scripts with administrator
92+
privileges.
93+
94+
### Mitigation
95+
96+
- Update to a patched version of `net-imap` which:
97+
- validates that `Net::IMAP::RawData` is composed of well-formed IMAP
98+
`text`, `literal`, and `literal8` values, with no unescaped `NULL`, `CR`,
99+
or `LF` bytes.
100+
- does not use `Net::IMAP::RawData` for `#store`, `#uid_store`, or
101+
`#setquota`.
102+
- Prefer to send search criteria as an array of key value pairs. Avoid
103+
sending it as an interpolated string.
104+
- If an immediate upgrade is not possible:
105+
- String inputs to search criteria and fetch attributes can be validated
106+
against command injection by checking for `\r` and `\n` characters.
107+
- Hard-coding the store `attr` argument is often appropriate.
108+
Alternatively, user controlled inputs can be restricted to a small
109+
enumerated list which is valid for the calling application.
110+
- Use `Kernel#Integer` to coerce and validate user controlled inputs to
111+
`#setquota` limit.
112+
cvss_v4: 5.8
113+
patched_versions:
114+
- "~> 0.4.24"
115+
- "~> 0.5.14"
116+
- ">= 0.6.4"
117+
related:
118+
url:
119+
- https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
120+
- https://github.com/ruby/net-imap/commit/0ec4fd351263e8b9a4f683713427827b7b1ad974
121+
- https://github.com/ruby/net-imap/commit/47c72186d272441878ca73c9499f66013829ca2f
122+
- https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b
123+
- https://github.com/ruby/net-imap/commit/a4f7649c3da77dec7631f03a037a478eb4330048
124+
- https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71
125+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
126+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
127+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
128+
- https://github.com/advisories/GHSA-hm49-wcqc-g2xg
129+
---

0 commit comments

Comments
 (0)