Описание
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps-legacy/xenial | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
| esm-apps/bionic | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
| esm-apps/focal | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
| esm-apps/noble | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
| esm-apps/resolute | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
| jammy | DNE | |
| noble | not-affected | no ResponseReader/SCRAM class in bundled net/imap.rb |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-infra-legacy/xenial | not-affected | no ResponseReader class in monolithic imap.rb |
| esm-infra/xenial | ignored | end of ESM support, was needs-triage |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | not-affected | no ResponseReader class; uses line-by-line get_response |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-infra/bionic | not-affected | ruby2.5 stdlib uses per-line response reading; no ResponseReader class |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | not-affected |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-infra/focal | not-affected | no ResponseReader class in monolithic imap.rb |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | not-affected | no ResponseReader class; uses line-by-line get_response |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | not-affected | no ResponseReader class in monolithic imap.rb |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | not-affected | no ResponseReader class; uses line-by-line get_response |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | DNE | |
| noble | not-affected | no ResponseReader class; net-imap 0.3.4.1 predates ResponseReader |
| questing | DNE | |
| resolute | DNE | |
| upstream | not-affected | no ResponseReader class; net-imap 0.3.4.1 predates ResponseReader |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| jammy | DNE | |
| noble | DNE | |
| questing | ignored | end of standard support |
| resolute | not-affected | no ResponseReader class in net-imap 0.4.19 |
| upstream | not-affected | no ResponseReader class in net-imap 0.4.19 |
Показывать по
Ссылки на источники
7.5 High
CVSS3
Связанные уязвимости
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Net::IMAP implements Internet Message Access Protocol (IMAP) client fu ...
net-imap has quadratic complexity when reading response literals
7.5 High
CVSS3