Skip to content

Commit 85b6b5a

Browse files
jasnowsimi
jasnow
authored and
simi
committed
GHSA/SYNC: 3 new net-imap advisories
1 parent 9e5b262 commit 85b6b5a

3 files changed

Lines changed: 262 additions & 0 deletions

File tree

‎gems/net-imap/CVE-2026-47240.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-47240
4+
ghsa: 8p34-64r3-mwg8
5+
url: https://www.cve.org/CVERecord?id=CVE-2026-47240
6+
title: 'Net::IMAP: Command Injection via non-synchronizing literal
7+
in "raw" argument'
8+
date: 2026-06-09
9+
description: |
10+
Several Net::IMAP commands accept a "raw data" argument that is sent
11+
verbatim after validation to prevent command injection. However,
12+
if a server does not support non-synchronizing literals, it may
13+
still be possible to inject arbitrary IMAP commands inside
14+
non-synchronizing literals.
15+
16+
### Details
17+
18+
Raw data arguments support embedded literal values, both synchronizing
19+
and non-synchronizing. Non-synchronizing literals can only be safely
20+
sent when the server advertises any of the `LITERAL+`, `LITERAL-`, or
21+
`IMAP4rev2` capabilities. But raw data arguments do not verify server
22+
support for non-synchronizing literals prior to sending.
23+
24+
Servers without support for non-synchronizing literals could handle
25+
them in several different ways: If a server sees a `"}\r\n"` byte
26+
sequence but can't parse the literal bytesize, it _may_ cautiously
27+
decide to close the connection, blocking any command injection attacks.
28+
However, a server without support for non-synchronizing literals may
29+
instead interpret the `"+}\r\n"` as the end of a malformed command
30+
line and respond with a tagged `BAD`. In that case, the contents
31+
of the literal will be interpreted as one or more new pipelined
32+
commands, allowing a CRLF command injection attack to succeed.
33+
34+
This affects the following commands' string arguments:
35+
* `criteria` for `#search` and `#uid_search`
36+
* `search_keys` for `#sort`, `#thread`, `#uid_sort`, and `#uid_thread`
37+
* `attr` for `#fetch` and `#uid_fetch`
38+
39+
Prior to `net-imap` v0.6.4, v0.5.14, and v0.4.24, raw data arguments
40+
were not validated in _any_ way, so they were also vulnerable to
41+
this attack. See CVE-2026-42257 (GHSA-hm49-wcqc-g2xg).
42+
43+
### Impact
44+
45+
Fortunately, `LITERAL-` is supported by most modern IMAP servers. Even
46+
without support for non-synchronizing literals, cautious servers may
47+
handle invalid literal bytesize by closing the connection . However,
48+
servers which handle a non-synchronizing literal just like any other
49+
malformed command will enable this vulnerability.
50+
51+
If a developer passes an unvalidated user-controlled input for one
52+
of these method arguments, an attacker can append CRLF sequence
53+
followed by a new IMAP command (like DELETE mailbox). Although this
54+
does not directly enable data exfiltration, it could be combined with
55+
other attack vectors or knowledge of the target system's attributes,
56+
e.g.: shared mail folders or the application's installed response handlers.
57+
58+
### Mitigation
59+
60+
Update to a version of `net-imap` which validates server support
61+
for non-synchronizing literals before sending them.
62+
63+
If upgrading `net-imap` is not possible:
64+
* Explicitly validate user-controlled inputs to prevent embedded
65+
non-synchronizing literals unless the server supports them.
66+
* For a simpler, more cautious approach: all embedded literals can
67+
be unconditionally prohibited, by checking that string inputs
68+
do not contain any CR or LF bytes.
69+
* Verify that the server advertises any of the `LITERAL+`, `LITERAL-`,
70+
or `IMAP4rev2` capabilities before using untrusted string inputs
71+
for the affected "raw data" arguments.
72+
cvss_v3: 5.8
73+
patched_versions:
74+
- "~> 0.5.15"
75+
- ">= 0.6.4.1"
76+
related:
77+
url:
78+
- https://www.cve.org/CVERecord?id=CVE-2026-47240
79+
- https://rubygems.org/gems/net-imap/versions/0.6.4.1
80+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4.1
81+
- https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8
82+
- https://github.com/advisories/GHSA-8p34-64r3-mwg8
83+
notes: |
84+
- cve is reserved
85+
- cvss_v3 - in GHSA ; No cvss_v2, cvss_v4 values.

‎gems/net-imap/CVE-2026-47241.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-47241
4+
ghsa: c4fp-cxrr-mj66
5+
url: https://www.cve.org/CVERecord?id=CVE-2026-47241
6+
title: 'Net::IMAP: Denial of Service via incomplete raw argument validation'
7+
date: 2026-06-09
8+
description: |
9+
10+
### Summary
11+
12+
Several Net::IMAP commands accept a raw string argument which is only
13+
validated to prevent CRLF injection and then sent verbatim. If this
14+
string is derived from user-controlled input, an attacker can force
15+
the next command to be absorbed as a continuation of the first command.
16+
This will cause the first command to eventually fail, but also prevents
17+
it from returning until another command is sent (from another thread).
18+
That other command will not return until the connection is closed.
19+
20+
### Details
21+
22+
`Net::IMAP::RawData` was hardened in v0.6.4, v0.5.14, and v0.4.24 to
23+
reject string arguments that would smuggle an invalid literal-continuation
24+
marker onto the wire (CVE-2026-42257, GHSA-hm49-wcqc-g2xg). But the
25+
trailing-marker check uses an incorrect regex which does not match
26+
`{0}` or `{0+}`, so an attacker-controlled seach `criteria` or fetch
27+
`attr` string ending in `{0}` or `{0+}` passes validation and is sent
28+
verbatim. Since these arguments are sent as the last argument in the
29+
command, they will be followed by CRLF. Although the CRLF was intended
30+
to end the command, the server will interpret it as part of a literal
31+
prefix. This consumes the next command the client puts on the socket
32+
as additional arguments to the current command.
33+
34+
This affects the following command's arguments:
35+
* `criteria` for `#search` and `#uid_search`
36+
* `search_keys` for `#sort`, `#thread`, `#uid_sort`, and `#uid_thread`
37+
* `attr` for `#fetch` and `#uid_fetch`
38+
39+
The command which contained the attacker's raw data will not be able
40+
to complete until the _next_ command is issued. If commands are only
41+
sent from single thread, the first command will hang until the connection
42+
times out (most likely by the server closing the connection).
43+
44+
If a second command is sent _(from another thread)_, this would allow
45+
the server to respond to the first command. This combined command
46+
_will_ be invalid:
47+
* The `{0}\\r\\n` literal prohibits other arguments (such as a quoted
48+
string) from spanning both commands
49+
* It will be sent without the space delimiter which is required
50+
between arguments.
51+
* The second command's tag will not be a valid argument to any of the
52+
vulnerable commands.
53+
54+
So the server _should_ respond to the first command with a `BAD` response,
55+
which will raise a `BadResponseError`.
56+
57+
But, since the server never saw a second command, the second command will
58+
never receive a tagged response and the thread that sent it will hang until
59+
the connection is closed.
60+
61+
### Impact
62+
63+
This will result in unexpected crashes and timeouts, which could be used
64+
to create a simple denial of service attack. This attack will present
65+
very similarly to common network issues or server issues which also result
66+
in commands hanging or unexpectedly raising exceptions. By itself, this
67+
does not allow command injection. But the confusion caused by these
68+
errors could lead to other downstream issues, especially in a
69+
multi-threaded environment.
70+
71+
### Mitigation
72+
73+
Update to a patched version of `net-imap` which validates that `RawData`
74+
arguments may not end with literal continuation markers.
75+
If `net-imap` cannot be upgraded:\n* Validate that user input to the
76+
affected command arguments does not end with `\"}\"`.
77+
* Use of `Timeout` or other standard strategies for slow connections
78+
and misbehaving servers will also mitigate the effects of this.
79+
80+
### Extra caution is required when issuing commands from multiple threads.
81+
82+
While `net-imap` does have rudimentary support for issuing commands
83+
from multiple threads, the user is responsible for synchronizing that
84+
commands are issued in a logically coherent order, and for ensuring
85+
that commands are only pipelined when it is safe to do so.
86+
87+
Practically, this means that many commands cannot be safely pipelined together,
88+
and user code will often need to wait for state changing commands to successfully
89+
complete before issuing commands that rely on that state change.
90+
cvss_v3: 2.1
91+
patched_versions:
92+
- "~> 0.5.15"
93+
- ">= 0.6.4.1"
94+
related:
95+
url:
96+
- https://www.cve.org/CVERecord?id=CVE-2026-47241
97+
- https://rubygems.org/gems/net-imap/versions/0.6.4.1
98+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4.1
99+
- https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66
100+
- https://github.com/advisories/GHSA-c4fp-cxrr-mj66
101+
notes: |
102+
- cve is reserved
103+
- cvss_v3 - in GHSA ; No cvss_v2, cvss_v4 values.

‎gems/net-imap/CVE-2026-47242.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
gem: net-imap
3+
cve: 2026-47242
4+
ghsa: 46q3-7gv7-qmgg
5+
url: https://www.cve.org/CVERecord?id=CVE-2026-47242
6+
title: 'Net::IMAP: Command Injection via ID command argument'
7+
date: 2026-06-09
8+
description: |
9+
### Summary
10+
11+
Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their
12+
arguments. Arguments to either command could be used by an attacker
13+
to inject arbitrary IMAP commands.
14+
15+
Please note that passing untrusted inputs to these commands is usually
16+
inappropriate and expected to be uncommon.
17+
18+
### Details
19+
20+
When `Net::IMAP#id` is called with a hash argument, although the ID
21+
field value strings are correctly quoted (escaping quoted specials),
22+
they were not validated to prohibit CRLF sequences.
23+
24+
While `Net::IMAP#enable` does process its arguments for aliases, it
25+
does not validate them as valid atoms (or as a list of valid atoms).
26+
The `#to_s` value is sent verbatim.
27+
28+
### Impact
29+
30+
This is expected to impact very few users: use of untrusted user input
31+
for either command is expected to be very uncommon.
32+
33+
The documentation for `#enable` explicitly warns that using any arguments
34+
that are not in the explicitly supported list may result in undocumented
35+
behavior. Using arbitrary untrusted user input for `#enable` will always
36+
be inappropriate.
37+
38+
Although client ID field values will most commonly be static and hardcoded,
39+
dynamic input sources may be used. For example, client ID fields may be
40+
set by configuration or version numbers. Using untrusted user inputs
41+
for client ID fields is expected to be uncommon. But any untrusted
42+
inputs to client ID can trivially exploit this vulnerability.
43+
44+
Untrusted inputs to either command may include a CRLF sequence followed
45+
by a new IMAP command (like DELETE mailbox). Although this does not
46+
directly enable data exfiltration, it could be combined with other
47+
attack vectors or knowledge of the target system's attributes,
48+
e.g.: shared mail folders or the application's installed response handlers.
49+
50+
### Mitigation
51+
52+
Update to a version of `net-imap` which validates `#id` and `#enable`
53+
arguments.
54+
55+
Untrusted inputs should _never_ be used for `#enable` arguments.
56+
57+
If `net-imap` cannot be upgraded:
58+
* do not use untrusted inputs for client ID field values
59+
* or add validation that client ID field values must not contain
60+
any CR or LF bytes.
61+
cvss_v3: 4.3
62+
patched_versions:
63+
- "~> 0.5.15"
64+
- ">= 0.6.4.1"
65+
related:
66+
url:
67+
- https://www.cve.org/CVERecord?id=CVE-2026-47242
68+
- https://rubygems.org/gems/net-imap/versions/0.6.4.1
69+
- https://github.com/ruby/net-imap/releases/tag/v0.6.4.1
70+
- https://github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmgg
71+
- https://github.com/advisories/GHSA-46q3-7gv7-qmgg
72+
notes: |
73+
- cve is reserved
74+
- cvss_v3 - in GHSA ; No cvss_v2, cvss_v4 values.

0 commit comments

Comments
 (0)