Improper resource allocation In ruby3.3
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | - | ||
debian 14 | - | ||
 rpm rhel8 | 0:3.3.10-7.module+el8.10.0+24407+4a33a056 | ||
rpm rhel10 | 0:3.3.10-13.el10_2 | ||
rpm rhel9 | 0:3.3.10-7.module+el9.8.0+24406+8975e57f | ||
rpm rhel10 | 0:4.0.3-35.el10_2 | ||
debian 13 | - | ||
 rubygems | 0.6.4, 0.5.14, 0.4.24 | ||
rpm rhel10.0 | 0:3.3.10-11.el10_0.2 | ||
rpm rhel9.6 | 0:3.3.10-6.module+el9.6.0+24475+76cce029 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8.