Skip to content

Commit f18c041

Browse files
jasnowpostmodern
jasnow
and
postmodern
authored
GHSA SYNC: 1 brand new and 4 modified advisories (#870)
--------- Co-authored-by: Postmodern <postmodern.mod3@gmail.com>
1 parent f46efd7 commit f18c041

File tree

4 files changed

+134
-1
lines changed

4 files changed

+134
-1
lines changed

‎gems/activestorage/CVE-2024-26144.yml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,11 @@ description: |
1414
1515
This vulnerability has been assigned the CVE identifier CVE-2024-26144.
1616
17-
Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, >= 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7
17+
Versions Affected: >= 5.2.0, < 7.1.0
18+
19+
Not affected: < 5.2.0, >= 7.1.0
20+
21+
Fixed Versions: 7.0.8.1, 6.1.7.7
1822
1923
# Impact
2024
@@ -43,3 +47,7 @@ unaffected_versions:
4347
patched_versions:
4448
- "~> 6.1.7, >= 6.1.7.7"
4549
- ">= 7.0.8.1"
50+
related:
51+
url:
52+
- https://nvd.nist.gov/vuln/detail/CVE-2024-26144
53+
- https://hackerone.com/reports/3082917

‎gems/cgi/CVE-2025-27219.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,5 @@ related:
3535
url:
3636
- https://www.cve.org/CVERecord?id=CVE-2025-27219
3737
- https://www.suse.com/security/cve/CVE-2025-27219.html
38+
- https://hackerone.com/reports/3013913
3839
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

‎gems/net-imap/CVE-2025-43857.yml

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
gem: net-imap
3+
cve: 2025-43857
4+
ghsa: j3g3-5qv5-52mj
5+
url: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
6+
title: net-imap rubygem vulnerable to possible DoS by memory exhaustion
7+
date: 2025-04-28
8+
description: |
9+
### Summary
10+
11+
There is a possibility for denial of service by memory exhaustion
12+
when `net-imap` reads server responses. At any time while the client
13+
is connected, a malicious server can send can send a "literal" byte
14+
count, which is automatically read by the client's receiver thread.
15+
The response reader immediately allocates memory for the number of
16+
bytes indicated by the server response.
17+
18+
This should not be an issue when securely connecting to trusted IMAP
19+
servers that are well-behaved. It can affect insecure connections
20+
and buggy, untrusted, or compromised servers (for example, connecting
21+
to a user supplied hostname).
22+
23+
### Details
24+
25+
The IMAP protocol allows "literal" strings to be sent in responses,
26+
prefixed with their size in curly braces (e.g. `{1234567890}`).
27+
When `Net::IMAP` receives a response containing a literal string,
28+
it calls `IO#read` with that size. When called with a size,
29+
`IO#read` immediately allocates memory to buffer the entire string
30+
before processing continues. The server does not need to send any
31+
more data. There is no limit on the size of literals that will be
32+
accepted.
33+
34+
### Fix
35+
#### Upgrade
36+
Users should upgrade to `net-imap` 0.5.7 or later. A configurable
37+
`max_response_size` limit has been added to `Net::IMAP`'s response
38+
reader. The `max_response_size` limit has also been backported to
39+
`net-imap` 0.2.5, 0.3.9, and 0.4.20.
40+
41+
To set a global value for `max_response_size`, users must upgrade
42+
to `net-imap` ~> 0.4.20, or > 0.5.7.
43+
44+
#### Configuration
45+
46+
To avoid backward compatibility issues for secure connections to
47+
trusted well-behaved servers, the default `max_response_size` for
48+
`net-imap` 0.5.7 is _very high_ (512MiB), and the default
49+
`max_response_size` for `net-imap` ~> 0.4.20, ~> 0.3.9, and 0.2.5
50+
is `nil` (unlimited).
51+
52+
When connecting to untrusted servers or using insecure connections,
53+
a much lower `max_response_size` should be used.
54+
```ruby
55+
# Set the global max_response_size (only ~> v0.4.20, > 0.5.7)
56+
Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB
57+
58+
# Set when creating the connection
59+
imap = Net::IMAP.new(hostname, ssl: true,
60+
max_response_size: 16 << 10) # 16 KiB
61+
62+
# Set after creating the connection
63+
imap.max_response_size = 256 << 20 # 256 KiB
64+
# flush currently waiting read, to ensure the new setting is loaded
65+
imap.noop
66+
```
67+
68+
_**Please Note:**_ `max_response_size` only limits the size _per
69+
response_. It does not prevent a flood of individual responses
70+
and it does not limit how many unhandled responses may be stored
71+
on the responses hash. Users are responsible for adding response
72+
handlers to prune excessive unhandled responses.
73+
74+
#### Compatibility with lower `max_response_size`
75+
76+
A lower `max_response_size` may cause a few commands which
77+
legitimately return very large responses to raise an exception
78+
and close the connection. The `max_response_size` could be
79+
temporarily set to a higher value, but paginated or limited
80+
versions of commands should be used whenever possible. For
81+
example, to fetch message bodies:
82+
83+
```ruby
84+
imap.max_response_size = 256 << 20 # 256 KiB
85+
imap.noop # flush currently waiting read
86+
87+
# fetch a message in 252KiB chunks
88+
size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size
89+
limit = 252 << 10
90+
message = ((0..size)limit).each_with_object("") {|offset, str|
91+
str << imap.uid_fetch(uid,
92+
"BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:)
93+
}
94+
95+
imap.max_response_size = 16 << 20 # 16 KiB
96+
imap.noop # flush currently waiting read
97+
```
98+
99+
### References
100+
101+
* PR to introduce max_response_size: https://github.com/ruby/net-imap/pull/442
102+
* Specific commit: [0ae8576c1 - lib/net/imap/response_reader.rb](https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462)
103+
* Backport to 0.4: https://github.com/ruby/net-imap/pull/445
104+
* Backport to 0.3: https://github.com/ruby/net-imap/pull/446
105+
* Backport to 0.2: https://github.com/ruby/net-imap/pull/447
106+
cvss_v4: 6.0
107+
patched_versions:
108+
- "~> 0.2.5"
109+
- "~> 0.3.9"
110+
- "~> 0.4.20"
111+
- ">= 0.5.7"
112+
related:
113+
url:
114+
- https://nvd.nist.gov/vuln/detail/CVE-2025-43857
115+
- https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
116+
- https://github.com/ruby/net-imap/pull/442
117+
- https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462
118+
- https://github.com/ruby/net-imap/pull/445
119+
- https://github.com/ruby/net-imap/pull/446
120+
- https://github.com/ruby/net-imap/pull/447
121+
- https://nvd.nist.gov/vuln/detail/CVE-2025-43857
122+
- https://github.com/advisories/GHSA-j3g3-5qv5-52mj
123+
- https://hackerone.com/reports/3108869

‎gems/rexml/CVE-2024-43398.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,5 +49,6 @@ related:
4949
- https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
5050
- https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3
5151
- https://github.com/ruby/rexml/releases/tag/v3.3.6
52+
- https://hackerone.com/reports/3002543
5253
- https://hackerone.com/reports/2666849
5354
- https://github.com/advisories/GHSA-vmwr-mc7x-5vc3

0 commit comments

Comments
 (0)