v0.4.24

Important

The 0.4.x release branch will only receive critical security fixes, and will be unsupported when ruby 3.3 is EOL.
Please upgrade to a newer version.

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

Warning

#666 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp).
Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

Important

Argument validation is significantly improved. Several injection vulnerabilities have been fixed:
#663 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px).
#663 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg)
#663 fixes CRLF/command/argument injection via the storage_limit argument to #setquota (GHSA-hm49-wcqc-g2xg).
#663 fixes CRLF/command injection via RawData (GHSA-hm49-wcqc-g2xg):

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String.
  When attr is an Array, its String members are sent as raw data.

Caution

RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

Note

Two denial of service vulnerabilities have been addressed.
These are generally only relevant when connecting to an untrusted hostile server (or without TLS).

#651 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw).
#655 adds a configurable max_iterations count for SCRAM-* authentication (GHSA-87pf-fpwv-p7m7).

The default ScramAuthenticator#max_iterations is 2**31 - 1 (max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.

Added

• 🔒 Add ScramAuthenticator#max_iterations (backports #654) in #655, reported by @Masamuneee

Fixed

• 🔒 Fix STARTTLS stripping vulnerability (backports #664) in #666, reported by @Masamuneee
• 🔒 Fix CRLF injection vulnerabilities (backports #657, #658, #659, #660, #636, #661) in #663, reported by @manunio
• ⚡ Much faster ResponseReader performance (backports #642) in #651, reported by @Masamuneee
• 🐛 Wait to continue RawData literals (backports #660) by @nevans in #663

Other Changes

• ♻️ Improve internal literal sending (partially backports #358, #616, #649) by @nevans in #653

Full Changelog: v0.4.23...v0.4.24