Bug 2344680 (CVE-2025-25186) - CVE-2025-25186 net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion
Summary: CVE-2025-25186 net-imap: Net::IMAP vulnerable to possible DoS by memory exhau...
Keywords:
Status: NEW
Alias: CVE-2025-25186
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2345556 2345557
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-10 17:01 UTC by OSIDB Bzimport
Modified: 2025-04-16 10:29 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:3906 0 None None None 2025-04-16 10:29:36 UTC

Description OSIDB Bzimport 2025-02-10 17:01:08 UTC
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser.  At any time while the client is connected, a malicious server can send  can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.

Comment 2 Vít Ondruch 2025-02-12 09:49:38 UTC
Checking Ruby, if I am not mistaken, Ruby 3.1 shipped `rubygem(net-imap) = 0.2.3`, therefore `ruby` package should be fine up to Ruby 3.1 and the first possible vulnerable package is Ruby 3.2, shipping with `rubygem(net-imap) = 0.3.4`

Comment 5 errata-xmlrpc 2025-04-16 10:29:34 UTC
This issue has been addressed in the following products:

  RHOL-5.9-RHEL-9

Via RHSA-2025:3906 https://access.redhat.com/errata/RHSA-2025:3906


Note You need to log in before you can comment on or make changes to this bug.