REDHAT-BUG-2344680
First published: Mon Feb 10 2025(Updated: )
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby net-imap | >=0.3.2<0.3.8<0.4.19<0.5.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2344680?
The severity of REDHAT-BUG-2344680 is classified as a denial of service vulnerability due to potential memory exhaustion.
How do I fix REDHAT-BUG-2344680?
To fix REDHAT-BUG-2344680, upgrade to net-imap versions 0.3.8, 0.4.19, or 0.5.6 or later.
Which versions of net-imap are affected by REDHAT-BUG-2344680?
Versions of net-imap from 0.3.2 to 0.3.8, as well as any version prior to 0.4.19 and 0.5.6, are affected by REDHAT-BUG-2344680.
What type of vulnerability is REDHAT-BUG-2344680?
REDHAT-BUG-2344680 is a denial of service vulnerability associated with memory exhaustion in the net-imap response parser.
Who is impacted by REDHAT-BUG-2344680?
Users and applications utilizing the affected versions of Ruby's net-imap library are impacted by REDHAT-BUG-2344680.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-25186
- agent/severity
- agent/references
- agent/last-modified-date
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/ruby
- canonical/ruby net-imap