Skip to content

Commit 1029304

Browse files
flavorjonesflavorjones
authored
GHSA/SYNC: 5 brand new net-imap advisories (#1042)
1 parent d5ea971 commit 1029304

5 files changed

Lines changed: 409 additions & 0 deletions

File tree

‎gems/net-imap/CVE-2026-42245.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42245
4+
ghsa: q2mw-fvj9-vvcw
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
6+
title: net-imap has quadratic complexity when reading response literals
7+
date: 2026-05-04
8+
description: |
9+
### Summary
10+
11+
`Net::IMAP::ResponseReader` has quadratic time complexity when reading large
12+
responses containing many string literals. A hostile server can send
13+
responses which are crafted to exhaust the client's CPU for a denial of
14+
service attack.
15+
16+
### Details
17+
18+
For each literal in a response, `ResponseReader` rescans the entire growing
19+
response buffer. The regular expression that is used to scan the response
20+
buffer runs in linear time. With many literals, this becomes O(n²) total
21+
work. The regular expression should run in constant time: it is anchored to
22+
the end and only the last 23 bytes of the buffer are relevant.
23+
24+
Because the algorithmic complexity is super-linear, this bypasses protection
25+
from `max_response_size`: a response can stay well below the default size
26+
limit while still causing very large CPU cost.
27+
28+
`Net::IMAP::ResponseReader` runs continuously in the receiver thread until the
29+
connection closes.
30+
31+
### Impact
32+
33+
This consumes disproportionate CPU time in the client's receiver thread. A
34+
hostile server could use this to exhaust the client's CPU for a denial of
35+
service attack.
36+
37+
For a response near the default `max_response_size`, each individual regexp
38+
scan could take between 100 to 200ms on common modern hardware, and this may
39+
be repeated 200k times per megabyte of response. While the regexp is
40+
scanning, it retains the Global VM lock, preventing other threads from
41+
running.
42+
43+
Although other threads should not be _completely_ blocked, their run time will
44+
be significantly impacted.
45+
46+
### Mitigation
47+
* Upgrade to a patched version of net-imap that reads responses more efficiently.
48+
* Do not connect to untrusted IMAP servers.
49+
* When connecting to untrusted servers, a _much_ smaller `max_response_size`
50+
(for example: 8KiB) will limit the impact. Although this is too small for
51+
fetching unpaginated message bodies, it should be enough for most other
52+
operations.
53+
54+
cvss_v4: 2.3
55+
patched_versions:
56+
- "~> 0.4.24"
57+
- "~> 0.5.14"
58+
- ">= 0.6.4"
59+
related:
60+
url:
61+
- https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw
62+
- https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96
63+
- https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda
64+
- https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819
65+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
66+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
67+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
68+
- https://github.com/advisories/GHSA-q2mw-fvj9-vvcw

‎gems/net-imap/CVE-2026-42246.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42246
4+
ghsa: vcgp-9326-pqcp
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
6+
title: net-imap vulnerable to STARTTLS stripping via invalid response timing
7+
date: 2026-05-04
8+
description: |
9+
### Summary
10+
11+
A man-in-the-middle attacker can cause `Net::IMAP#starttls` to return
12+
"successfully", without starting TLS.
13+
14+
### Details
15+
16+
When using `Net::IMAP#starttls` to upgrade a plaintext connection to use TLS,
17+
a man-in-the-middle attacker can inject a tagged `OK` response with an easily
18+
predictable tag. By sending the response before the client finishes sending
19+
the command, the command completes "successfully" before the response handler
20+
is registered. This allows `#starttls` to return without error, but the
21+
response handler is never invoked, the TLS connection is never established,
22+
and the socket remains unencrypted.
23+
24+
This allows man-in-the-middle attackers to perform a STARTTLS stripping
25+
attack, unless the client code explicitly checks `Net::IMAP#tls_verified?`.
26+
27+
### Impact
28+
29+
TLS bypass, leading to cleartext transmission of sensitive information.
30+
31+
### Mitigation
32+
33+
* Upgrade to a patched version of net-imap that raises an exception whenever
34+
`#starttls` does not establish TLS.
35+
* Connect to an implicit TLS port, rather than use `STARTTLS` with a cleartext
36+
port.
37+
This is strongly recommended anyway:
38+
* [RFC 8314](https://www.rfc-editor.org/info/rfc8314): Cleartext Considered
39+
Obsolete: Use of Transport Layer Security (TLS) for Email Submission and
40+
Access
41+
* [NO STARTTLS](https://nostarttls.secvuln.info/): Why TLS is better without
42+
STARTTLS, A Security Analysis of STARTTLS in the Email Context
43+
* Explicitly verify `Net::IMAP#tls_verified?` is `true`, before using the
44+
connection after `#starttls`.
45+
cvss_v4: 7.6
46+
patched_versions:
47+
- "~> 0.3.10"
48+
- "~> 0.4.24"
49+
- "~> 0.5.14"
50+
- ">= 0.6.4"
51+
related:
52+
url:
53+
- https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
54+
- https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
55+
- https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
56+
- https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
57+
- https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
58+
- https://github.com/ruby/net-imap/releases/tag/v0.3.10
59+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
60+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
61+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
62+
- https://nostarttls.secvuln.info
63+
- https://www.rfc-editor.org/info/rfc8314
64+
- https://github.com/advisories/GHSA-vcgp-9326-pqcp

‎gems/net-imap/CVE-2026-42256.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42256
4+
ghsa: 87pf-fpwv-p7m7
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
6+
title: net-imap vulnerable to denial of service via high iteration count for `SCRAM-*`
7+
authentication
8+
date: 2026-05-04
9+
description: |
10+
### Summary
11+
12+
When authenticating a connection with `SCRAM-SHA1` or `SCRAM-SHA256`, a
13+
hostile server can perform a computational denial-of-service attack on the
14+
client process by sending a big iteration count value.
15+
16+
### Details
17+
18+
A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in
19+
the SCRAM server-first-message, causing the client to perform an expensive
20+
`OpenSSL::KDF.pbkdf2_hmac` call. Because the PBKDF2 function is a blocking C
21+
extension and holds onto Ruby’s Global VM Lock, it can freeze the entire Ruby
22+
VM for the duration of the computation.
23+
24+
OpenSSL enforces an effective maximum by using a 32-bit signed integer for the
25+
iteration count, Depending on hardware capabilities and OpenSSL version, this
26+
iteration count may be sufficient for to block all Ruby threads in the process
27+
for over seven minutes.
28+
29+
This is listed as one of the \"Security Considerations\", in [RFC
30+
7804](https://www.rfc-editor.org/rfc/rfc7804.html#page-15):
31+
32+
> A hostile server can perform a computational denial-of-service attack on
33+
> clients by sending a big iteration count value. In order to defend against
34+
> that, a client implementation can pick a maximum iteration count that it is
35+
> willing to use and reject any values that exceed that threshold (in such
36+
> cases, the client, of course, has to fail the authentication).
37+
38+
### Impact
39+
40+
During SCRAM authentication to a hostile server, the entire Ruby VM will be
41+
locked for the duration of the computation. Depending on hardware
42+
capabilities and OpenSSL version, this may take many minutes.
43+
44+
`OpenSSL::KDF.pbkdf2_hmac` is a blocking C function, so `Timeout` cannot be
45+
used to guard against this. And it retains the Global VM lock, so other ruby
46+
threads will also be unable to run.
47+
48+
### Mitigation
49+
50+
* Upgrade to a patched version of `net-imap` that adds the `max_iterations`
51+
option to the `SASL-*` authenticators, and call `Net::IMAP#authenticate`
52+
with a `max_iterations` keyword argument.
53+
54+
**NOTE:** The default `max_iterations` is `2³¹ - 1`, the maximum signed 32
55+
bit integer, the maximum allowed by OpenSSL.
56+
57+
_To prevent a denial of service attack,_ this must be set to a safe value,
58+
depending on hardware and version of OpenSSL. _It is the user's
59+
responsibility_ to enforce minimum and maximum iteration counts that are
60+
appropriate for their security context.
61+
62+
* Alternatively, avoid `SCRAM-*` mechanisms when authenticating to untrusted
63+
servers.
64+
cvss_v4: 6.0
65+
unaffected_versions:
66+
- "< 0.4.0"
67+
patched_versions:
68+
- "~> 0.4.24"
69+
- "~> 0.5.14"
70+
- ">= 0.6.4"
71+
related:
72+
url:
73+
- https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7
74+
- https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612
75+
- https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4
76+
- https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758
77+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
78+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
79+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
80+
- https://www.rfc-editor.org/rfc/rfc7804.html#page-15
81+
- https://github.com/advisories/GHSA-87pf-fpwv-p7m7

‎gems/net-imap/CVE-2026-42257.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-42257
4+
ghsa: hm49-wcqc-g2xg
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
6+
title: net-imap vulnerable to command Injection via "raw" arguments to multiple commands
7+
date: 2026-05-04
8+
description: |
9+
### Summary
10+
11+
Several `Net::IMAP` commands accept a raw string argument that is sent to the
12+
server without validation or escaping. If this string is derived from
13+
user-controlled input, it may contain contain `CRLF` sequences, which an
14+
attacker can use to inject arbitrary IMAP commands.
15+
16+
### Details
17+
18+
`Net::IMAP`'s generic argument handling, used by most command arguments,
19+
interprets string arguments as an IMAP `astring`. Depending on the string
20+
contents and the connection's UTF-8 support, this encodes strings as either a
21+
`atom`, `quoted`, or `literal`. These are safe from command or argument
22+
injection.
23+
24+
But the following commands transform specific String arguments to
25+
`Net::IMAP::RawData`, which bypasses normal argument validation and encoding
26+
and prints the string directly to the socket:
27+
28+
* `#uid_search`, `#search`
29+
* when `criteria` is a String, it is sent raw
30+
* `#uid_fetch`, `#fetch`
31+
* when `attr` is a String, it is sent raw
32+
* when `attr` is an Array, each String in `attr` is sent raw
33+
* `#uid_store`, `#store`
34+
* when `attr` is a String, it is sent raw
35+
* `#setquota`:
36+
* `limit` is interpolated with `#to_s` and that string is sent raw
37+
38+
Because these string arguments are sent without any neutralization, they serve
39+
as a direct vector for command splitting. Any user controlled data
40+
interpolated into these strings can be used to break out of the intended
41+
command context.
42+
43+
Using "raw data" arguments for `#uid_store`, `#store`, and `#setquota` I both
44+
inappropriate and unnecessary. `Net::IMAP`'s generic argument handling is
45+
sufficient to safely validate and encode their arguments. Users of the
46+
library probably do not expect arguments to these commands to be sent raw and
47+
might not be wary of passing unvalidated input.
48+
49+
The API for search criteria and fetch attributes is intentionally low-level
50+
and "close to the wire". It allows developers to use some IMAP extensions
51+
without requiring explicit support from the library and allows developers to
52+
use complex IMAP grammar without complex argument translation. Even so, basic
53+
validation is appropriate and could neutralize command injection.
54+
55+
Although this was explicitly documented for search `criteria`, it was
56+
insufficiently documented for fetch `attr`. So developers may not have
57+
realized that the `attr` argument to `#fetch` and `#uid_fetch` is sent as "raw
58+
data".
59+
60+
### Impact
61+
62+
If a developer passes an unvalidated user-controlled input for one of these
63+
method arguments, an attacker can append CRLF sequence followed by a new IMAP
64+
command (like DELETE mailbox). Although this does not _directly_ enable data
65+
exfiltration, it could be combined with other attack vectors or knowledge of
66+
the target system's attributes, e.g.: shared mail folders or the application's
67+
installed response handlers.
68+
69+
The SEARCH, STORE, and FETCH commands, and their UID variants are some of the
70+
most commonly used features of the library. Applications that build search
71+
queries or fetch attributes dynamically based on user input (e.g., mail
72+
clients or archival tools) may be at significant risk.
73+
74+
Expected use of `Net::IMAP#setquota` is much more limited: `SETQUOTA` is often
75+
only usable by users with special administrative privileges. Depending on the
76+
server, quota administration might be managed through server configuration
77+
rather than via the IMAP protocol `SETQUOTA` command. It is expected to be
78+
uncommonly used in system administration scripts or in interactive sessions,
79+
it should be completely controlled by trusted users, and should only use
80+
trusted inputs. Calling `#setquota` with untrusted user input is expected to
81+
be a very uncommon use case. Please note however this might be combined with
82+
other attacks, for example CSRF, which provide unauthorized access to trusted
83+
inputs, and may specifically target users or scripts with administrator
84+
privileges.
85+
86+
### Mitigation
87+
88+
- Update to a patched version of `net-imap` which:
89+
- validates that `Net::IMAP::RawData` is composed of well-formed IMAP
90+
`text`, `literal`, and `literal8` values, with no unescaped `NULL`, `CR`,
91+
or `LF` bytes.
92+
- does not use `Net::IMAP::RawData` for `#store`, `#uid_store`, or
93+
`#setquota`.
94+
- Prefer to send search criteria as an array of key value pairs. Avoid
95+
sending it as an interpolated string.
96+
- If an immediate upgrade is not possible:
97+
- String inputs to search criteria and fetch attributes can be validated
98+
against command injection by checking for `\r` and `\n` characters.
99+
- Hard-coding the store `attr` argument is often appropriate.
100+
Alternatively, user controlled inputs can be restricted to a small
101+
enumerated list which is valid for the calling application.
102+
- Use `Kernel#Integer` to coerce and validate user controlled inputs to
103+
`#setquota` limit.
104+
cvss_v4: 5.8
105+
patched_versions:
106+
- "~> 0.4.24"
107+
- "~> 0.5.14"
108+
- ">= 0.6.4"
109+
related:
110+
url:
111+
- https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg
112+
- https://github.com/ruby/net-imap/commit/0ec4fd351263e8b9a4f683713427827b7b1ad974
113+
- https://github.com/ruby/net-imap/commit/47c72186d272441878ca73c9499f66013829ca2f
114+
- https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b
115+
- https://github.com/ruby/net-imap/commit/a4f7649c3da77dec7631f03a037a478eb4330048
116+
- https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71
117+
- https://github.com/ruby/net-imap/releases/tag/v0.4.24
118+
- https://github.com/ruby/net-imap/releases/tag/v0.5.14
119+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4
120+
- https://github.com/advisories/GHSA-hm49-wcqc-g2xg

0 commit comments

Comments
 (0)