Skip to content

Commit 997e516

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@f18c041 
1 parent 8b1242d commit 997e516

4 files changed

+142
-1
lines changed

‎advisories/_posts/2024-02-21-CVE-2024-26144.md

+9-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@ advisory:
2222
2323
This vulnerability has been assigned the CVE identifier CVE-2024-26144.
2424
25-
Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, >= 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7
25+
Versions Affected: >= 5.2.0, < 7.1.0
26+
27+
Not affected: < 5.2.0, >= 7.1.0
28+
29+
Fixed Versions: 7.0.8.1, 6.1.7.7
2630
2731
# Impact
2832
@@ -51,4 +55,8 @@ advisory:
5155
patched_versions:
5256
- "~> 6.1.7, >= 6.1.7.7"
5357
- ">= 7.0.8.1"
58+
related:
59+
url:
60+
- https://nvd.nist.gov/vuln/detail/CVE-2024-26144
61+
- https://hackerone.com/reports/3082917
5462
---

‎advisories/_posts/2024-08-22-CVE-2024-43398.md

+1
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ advisory:
5555
- https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
5656
- https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3
5757
- https://github.com/ruby/rexml/releases/tag/v3.3.6
58+
- https://hackerone.com/reports/3002543
5859
- https://hackerone.com/reports/2666849
5960
- https://github.com/advisories/GHSA-vmwr-mc7x-5vc3
6061
---

‎advisories/_posts/2025-02-26-CVE-2025-27219.md

+1
Original file line numberDiff line numberDiff line change
@@ -41,5 +41,6 @@ advisory:
4141
url:
4242
- https://www.cve.org/CVERecord?id=CVE-2025-27219
4343
- https://www.suse.com/security/cve/CVE-2025-27219.html
44+
- https://hackerone.com/reports/3013913
4445
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
4546
---

‎advisories/_posts/2025-04-28-CVE-2025-43857.md

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2025-43857 (net-imap): net-imap rubygem vulnerable to possible DoS by
4+
memory exhaustion'
5+
comments: false
6+
categories:
7+
- net-imap
8+
advisory:
9+
gem: net-imap
10+
cve: 2025-43857
11+
ghsa: j3g3-5qv5-52mj
12+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
13+
title: net-imap rubygem vulnerable to possible DoS by memory exhaustion
14+
date: 2025-04-28
15+
description: |
16+
### Summary
17+
18+
There is a possibility for denial of service by memory exhaustion
19+
when `net-imap` reads server responses. At any time while the client
20+
is connected, a malicious server can send can send a "literal" byte
21+
count, which is automatically read by the client's receiver thread.
22+
The response reader immediately allocates memory for the number of
23+
bytes indicated by the server response.
24+
25+
This should not be an issue when securely connecting to trusted IMAP
26+
servers that are well-behaved. It can affect insecure connections
27+
and buggy, untrusted, or compromised servers (for example, connecting
28+
to a user supplied hostname).
29+
30+
### Details
31+
32+
The IMAP protocol allows "literal" strings to be sent in responses,
33+
prefixed with their size in curly braces (e.g. `{1234567890}`).
34+
When `Net::IMAP` receives a response containing a literal string,
35+
it calls `IO#read` with that size. When called with a size,
36+
`IO#read` immediately allocates memory to buffer the entire string
37+
before processing continues. The server does not need to send any
38+
more data. There is no limit on the size of literals that will be
39+
accepted.
40+
41+
### Fix
42+
#### Upgrade
43+
Users should upgrade to `net-imap` 0.5.7 or later. A configurable
44+
`max_response_size` limit has been added to `Net::IMAP`'s response
45+
reader. The `max_response_size` limit has also been backported to
46+
`net-imap` 0.2.5, 0.3.9, and 0.4.20.
47+
48+
To set a global value for `max_response_size`, users must upgrade
49+
to `net-imap` ~> 0.4.20, or > 0.5.7.
50+
51+
#### Configuration
52+
53+
To avoid backward compatibility issues for secure connections to
54+
trusted well-behaved servers, the default `max_response_size` for
55+
`net-imap` 0.5.7 is _very high_ (512MiB), and the default
56+
`max_response_size` for `net-imap` ~> 0.4.20, ~> 0.3.9, and 0.2.5
57+
is `nil` (unlimited).
58+
59+
When connecting to untrusted servers or using insecure connections,
60+
a much lower `max_response_size` should be used.
61+
```ruby
62+
# Set the global max_response_size (only ~> v0.4.20, > 0.5.7)
63+
Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB
64+
65+
# Set when creating the connection
66+
imap = Net::IMAP.new(hostname, ssl: true,
67+
max_response_size: 16 << 10) # 16 KiB
68+
69+
# Set after creating the connection
70+
imap.max_response_size = 256 << 20 # 256 KiB
71+
# flush currently waiting read, to ensure the new setting is loaded
72+
imap.noop
73+
```
74+
75+
_**Please Note:**_ `max_response_size` only limits the size _per
76+
response_. It does not prevent a flood of individual responses
77+
and it does not limit how many unhandled responses may be stored
78+
on the responses hash. Users are responsible for adding response
79+
handlers to prune excessive unhandled responses.
80+
81+
#### Compatibility with lower `max_response_size`
82+
83+
A lower `max_response_size` may cause a few commands which
84+
legitimately return very large responses to raise an exception
85+
and close the connection. The `max_response_size` could be
86+
temporarily set to a higher value, but paginated or limited
87+
versions of commands should be used whenever possible. For
88+
example, to fetch message bodies:
89+
90+
```ruby
91+
imap.max_response_size = 256 << 20 # 256 KiB
92+
imap.noop # flush currently waiting read
93+
94+
# fetch a message in 252KiB chunks
95+
size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size
96+
limit = 252 << 10
97+
message = ((0..size)limit).each_with_object("") {|offset, str|
98+
str << imap.uid_fetch(uid,
99+
"BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:)
100+
}
101+
102+
imap.max_response_size = 16 << 20 # 16 KiB
103+
imap.noop # flush currently waiting read
104+
```
105+
106+
### References
107+
108+
* PR to introduce max_response_size: https://github.com/ruby/net-imap/pull/442
109+
* Specific commit: [0ae8576c1 - lib/net/imap/response_reader.rb](https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462)
110+
* Backport to 0.4: https://github.com/ruby/net-imap/pull/445
111+
* Backport to 0.3: https://github.com/ruby/net-imap/pull/446
112+
* Backport to 0.2: https://github.com/ruby/net-imap/pull/447
113+
cvss_v4: 6.0
114+
patched_versions:
115+
- "~> 0.2.5"
116+
- "~> 0.3.9"
117+
- "~> 0.4.20"
118+
- ">= 0.5.7"
119+
related:
120+
url:
121+
- https://nvd.nist.gov/vuln/detail/CVE-2025-43857
122+
- https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
123+
- https://github.com/ruby/net-imap/pull/442
124+
- https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462
125+
- https://github.com/ruby/net-imap/pull/445
126+
- https://github.com/ruby/net-imap/pull/446
127+
- https://github.com/ruby/net-imap/pull/447
128+
- https://nvd.nist.gov/vuln/detail/CVE-2025-43857
129+
- https://github.com/advisories/GHSA-j3g3-5qv5-52mj
130+
- https://hackerone.com/reports/3108869
131+
---

0 commit comments

Comments
 (0)