SB20261109126 - Fedora 43 update for ruby
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-41316)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper access control in ERB#def_module, ERB#def_method, and ERB#def_class when deserializing untrusted data with Marshal.load. A remote attacker can supply crafted serialized data to bypass the @_init guard and execute arbitrary code.
Exploitation requires both erb and activesupport to be loaded.
2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-42245)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to exhaust a net-imap client's CPU and cause a denial of service.
The vulnerability exists due to quadratic processing in Net::IMAP::ResponseReader when repeated scans of a growing response buffer process many string literals. An unauthenticated remote attacker can send crafted responses from a hostile IMAP server to a connected client, causing excessive CPU consumption even below the default max_response_size limit.
3) Command injection (CVE-ID: CVE-2026-42258)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to inject IMAP commands and delete mailboxes when a user triggers a vulnerable application command.
The vulnerability exists due to missing validation of Symbol arguments in net-imap when applications pass user-controlled input as Symbols to IMAP commands. An unprivileged local attacker can include CRLF sequences in a Symbol to terminate the original command and append a mailbox deletion command.
4) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-42246)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated network attacker to bypass TLS and expose sensitive information transmitted by an IMAP client.
The vulnerability exists due to net-imap accepting an early success response during a STARTTLS upgrade of a plaintext connection without ensuring TLS is established. An unauthenticated network attacker can intercept the connection and inject a predictably tagged response before the command finishes, leaving subsequent traffic unencrypted when the client does not explicitly verify TLS.
Remediation
Install update from vendor's website.