Bug 2344680 (CVE-2025-25186)

Summary:	CVE-2025-25186 net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akostadi, amasferr, cbartlet, chazlett, dmayorov, jaruga, jcantril, jlledo, kaycoth, mkudlej, mmakovy, rblanco, rojacob, tjochec, vmugicag, vondruch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Ruby's net-imap library. In certain versions, there is a possibility for denial of service by memory exhaustion in the `net-imap` response parser. At any time while the client is connected, a malicious server can send highly compressed `uid-set` data, which is automatically read by the client's receiver thread. The response parser converts the `uid-set` data into arrays of integers with no limitation on the expanded size of the ranges, which can trigger memory exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2345556, 2345557
Bug Blocks:

Description OSIDB Bzimport 2025-02-10 17:01:08 UTC

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser.  At any time while the client is connected, a malicious server can send  can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.

Comment 2 Vít Ondruch 2025-02-12 09:49:38 UTC

Checking Ruby, if I am not mistaken, Ruby 3.1 shipped `rubygem(net-imap) = 0.2.3`, therefore `ruby` package should be fine up to Ruby 3.1 and the first possible vulnerable package is Ruby 3.2, shipping with `rubygem(net-imap) = 0.3.4`

Comment 5 errata-xmlrpc 2025-04-16 10:29:34 UTC

This issue has been addressed in the following products:

  RHOL-5.9-RHEL-9

Via RHSA-2025:3906 https://access.redhat.com/errata/RHSA-2025:3906