Asymmetric denial of service In ruby3.3
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel9 | 0:3.3.12-8.module+el9.8.0+24568+2bbebe96 | ||
rpm rhel10 | 0:4.0.6-36.el10_2 | ||
 debian 12 | - | ||
debian 13 | - | ||
debian 14 | - | ||
rpm rhel10 | 0:3.3.12-14.el10_2 | ||
rpm rhel8 | 0:3.3.12-8.module+el8.10.0+24567+c4e5368e | ||
 rubygems | 0.6.4, 0.5.14, 0.4.24 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8. 9.