CVE-2025-43857

Publication date 28 April 2025

Last updated 14 May 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

Read the notes from the security team

Why is this CVE low priority?

Only a memory consumption issue when connecting to untrusted IMAP servers

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
jruby 25.04 plucky
Needs evaluation
24.10 oracular
Needs evaluation
24.04 LTS noble
Needs evaluation
22.04 LTS jammy Not in release
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty
Needs evaluation
ruby2.3 25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
16.04 LTS xenial
Needs evaluation
ruby2.5 25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
18.04 LTS bionic
Needs evaluation
ruby2.7 25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal
Needs evaluation
ruby3.0 25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble Not in release
22.04 LTS jammy
Needs evaluation
20.04 LTS focal Not in release
ruby3.2 25.04 plucky Not in release
24.10 oracular Not in release
24.04 LTS noble
Needs evaluation
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
ruby3.3 25.04 plucky
Needs evaluation
24.10 oracular
Needs evaluation
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release

Notes

mdeslaur

ruby3.0 contains net-imap 0.1.1 ruby3.2 contains net-imap 0.3.4.1 ruby3.3 contains net-imap 0.4.9.1 This fix introduces a new max_response_size to the API, but does not set a limited default to remain backwards compatible. Adding the upstream fix to stable releases will not result in this CVE being mitigated without individual applications using the API to be modified to use the new parameter. In addition, there are still other ways a malicious server could cause memory consumption on clients. Since this issue is only a memory consumption issue when connecting to untrusted servers via IMAP, and since the upstream fix doesn't actually change behaviour and would also require software using net-imap to use the new option, marking this CVE as being low priority.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
ruby3.0
ruby3.2
ruby3.3

Severity score breakdown

Parameter Value
Base score 7.5 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H