REDHAT-BUG-2344680: Medium severity Ruby net-imap vulnerability
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in net-imap's response parser. At any time while the client is connected, a malicious server can send can send highly compressed uid-set data which is automatically read by the client's receiver thread. The response parser uses Range#toa to convert the uid-set data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2344680?
The severity of REDHAT-BUG-2344680 is classified as a denial of service vulnerability due to potential memory exhaustion.
How do I fix REDHAT-BUG-2344680?
To fix REDHAT-BUG-2344680, upgrade to net-imap versions 0.3.8, 0.4.19, or 0.5.6 or later.
Which versions of net-imap are affected by REDHAT-BUG-2344680?
Versions of net-imap from 0.3.2 to 0.3.8, as well as any version prior to 0.4.19 and 0.5.6, are affected by REDHAT-BUG-2344680.
What type of vulnerability is REDHAT-BUG-2344680?
REDHAT-BUG-2344680 is a denial of service vulnerability associated with memory exhaustion in the net-imap response parser.
Who is impacted by REDHAT-BUG-2344680?
Users and applications utilizing the affected versions of Ruby's net-imap library are impacted by REDHAT-BUG-2344680.