Nevans

**Name of the Vulnerable Software and Affected Versions** Net::IMAP versions prior to 0.6.5 Net::IMAP versions prior to 0.5.15 **Description** Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Certain commands accept a raw data argument that is sent verbatim after validation. If a server does not support non-synchronizing literals (literals that do not require a server continuation response), it may interpret specific byte sequences as the end of a malformed command line. This allows an attacker to inject arbitrary IMAP commands via a CRLF (Carriage Return Line Feed) injection attack, where the contents of the literal are interpreted as new pipelined commands. This issue affects the `criteria` parameter for `search()` and `uid search()`, the `search keys` parameter for `sort()`, `thread()`, `uid sort()`, and `uid thread()`, and the `attr` parameter for `fetch()` and `uid fetch()`. **Recommendations** Update to version 0.6.5 or later. Update to version 0.5.15 or later. Explicitly validate user-controlled inputs to prevent embedded non-synchronizing literals unless the server supports them. Prohibit all embedded literals by ensuring string inputs do not contain any CR or LF bytes. Verify that the server advertises `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities before using untrusted string inputs for the affected raw data arguments.

**Name of the Vulnerable Software and Affected Versions** Net::IMAP versions prior to 0.5.15 Net::IMAP versions prior to 0.6.5 **Description** The `Net::IMAP#id` and `Net::IMAP#enable` functions do not properly validate their arguments. When `Net::IMAP#id` is called with a hash argument, it fails to prohibit CRLF (Carriage Return Line Feed) sequences, which are special characters used to indicate the end of a line. Similarly, `Net::IMAP#enable` does not validate arguments as valid atoms, sending the `#to s` value verbatim. An attacker providing untrusted input to these commands could inject arbitrary IMAP commands, such as deleting a mailbox. **Recommendations** Update to version 0.5.15. Update to version 0.6.5. Avoid using untrusted inputs for `Net::IMAP#enable` arguments. Ensure client ID field values do not contain CR or LF bytes or implement validation to prohibit these characters.