5.8Orta
CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commands
Açıklama
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg MitigationVendor Advisory
- https://github.com/ruby/net-imap/releases/tag/v0.4.24 Release Notes
- https://github.com/ruby/net-imap/releases/tag/v0.5.14 Release Notes
- https://github.com/ruby/net-imap/releases/tag/v0.6.4 Release Notes
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*< 0.4.24cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*≥ 0.5.0 < 0.5.14cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*≥ 0.6.0 < 0.6.4