Sourced from net-imap's releases.
v0.4.24
[!IMPORTANT] The
0.4.xrelease branch will only receive critical security fixes, and will be unsupported when ruby 3.3 is EOL. Please upgrade to a newer version.What's Changed
๐ Security
This release contains fixes for multiple vulnerabilities concerning
STARTTLSstripping, argument validation, and denial of service attacks.[!WARNING] ruby/net-imap#666 fixes a
STARTTLSstripping vulnerability (GHSA-vcgp-9326-pqcp). Without this fix, a man-in-the-middle attacker can causeNet::IMAP#starttlsto return "successfully", without starting TLS.[!IMPORTANT] Argument validation is significantly improved. Several injection vulnerabilities have been fixed: ruby/net-imap#663 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px). ruby/net-imap#663 fixes CRLF/command/argument injection via the
attrargument to#store/#uid_store(GHSA-hm49-wcqc-g2xg) ruby/net-imap#663 fixes CRLF/command/argument injection via thestorage_limitargument to#setquota(GHSA-hm49-wcqc-g2xg). ruby/net-imap#663 fixes CRLF/command injection viaRawData(GHSA-hm49-wcqc-g2xg):
#searchand#uid_searchsendcriteriaas raw data, when it is a String#fetchand#uid_fetchsendattras raw data, when it is a String. Whenattris an Array, its String members are sent as raw data.[!CAUTION]
RawDatadoes not defend against other forms of argument injection! It is an intentionally low-level API.[!NOTE] Two denial of service vulnerabilities have been addressed. These are generally only relevant when connecting to an untrusted hostile server (or without TLS).
ruby/net-imap#651 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw). ruby/net-imap#655 adds a configurable
max_iterationscount forSCRAM-*authentication (GHSA-87pf-fpwv-p7m7).The default
ScramAuthenticator#max_iterationsis2**31 - 1(max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.Added
- ๐ Add
ScramAuthenticator#max_iterations(backports #654) in ruby/net-imap#655, reported by@โMasamuneeeFixed
- ๐ Fix STARTTLS stripping vulnerability (backports #664) in ruby/net-imap#666, reported by
@โMasamuneee- ๐ Fix CRLF injection vulnerabilities (backports #657, #658, #659, #660, #636, #661) in ruby/net-imap#663, reported by
@โmanunio- โก Much faster ResponseReader performance (backports #642) in ruby/net-imap#651, reported by
@โMasamuneee- ๐ Wait to continue RawData literals (backports #660) by
@โnevansin ruby/net-imap#663Other Changes
- โป๏ธ Improve internal literal sending (partially backports #358, #616, #649) by
@โnevansin ruby/net-imap#653Full Changelog: https://github.com/ruby/net-imap/compare/v0.4.23...v0.4.24
... (truncated)
24a4e77
๐ Merge pull request #666
from ruby/backport/v0.4/STARTTLS-stripping63f53ff
๐ Bump version to 0.4.24038ae35
๐ pick 24d5c773d: ๐๐ฅ
Handle tagged "OK" to incomplete command
[backport #664]705aa59
๐ pick 62eea6ffe: ๐๐ฅ
Ensure STARTTLS tagged response was handled
[backport #664]c9a6f28
๐ pick 46636cae8: โ๐ Add failing test for STARTTLS stripping [backport
#664]aec0699
๐ Merge pull request #663
from ruby/backport/v0.4/raw_data-warningsfd245dd
๐ pick be32e712e: ๐ Improve documentation of RawData arguments
[backports #661]6dd110b
๐ pick 47c72186d: ๐ Validate RawData and wait to continue literals
[backports...4e93149
๐ Merge branch 'backport/v0.4/QUOTA-argument-validation' into
backport/v0.4/s...d2b2360
๐ pick 0ec4fd351: ๐ฅ
Validate #setquota storage limit
argument [backports #659]