SB20261109144 - openEuler 24.03 LTS SP1 update for ruby

Description

This security bulletin contains information about 4 vulnerabilities.

1) Command injection (CVE-ID: CVE-2026-47240)

CWE-ID: CWE-77 - Command injection

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unprivileged local attacker to inject arbitrary IMAP commands into an application's session and delete mailboxes.

The vulnerability exists due to net-imap accepting non-synchronizing literals in raw arguments without verifying server support. An unprivileged local attacker can supply input that an application passes unvalidated to affected arguments, causing servers lacking literal support that continue after malformed commands to execute embedded commands.

2) Improper Neutralization of Trailing Special Elements (CVE-ID: CVE-2026-47241)

CWE-ID: CWE-162 - Improper Neutralization of Trailing Special Elements

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated attacker to cause denial of service through hanging IMAP commands and timeouts.

The vulnerability exists due to incomplete trailing-marker validation in net-imap raw arguments when an application passes user-controlled input to affected commands. A remote authenticated attacker can supply arguments ending in {0} or {0+} for a victim to process, causing the server to absorb the next command and leave requests blocked.

3) Command injection (CVE-ID: CVE-2026-47242)

CWE-ID: CWE-77 - Command injection

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a highly privileged local attacker to inject arbitrary IMAP commands and delete mailboxes through an affected application.

The vulnerability exists due to missing argument validation in net-imap's Net::IMAP#id and Net::IMAP#enable methods when untrusted input contains command-separating CRLF sequences. A highly privileged local attacker can supply CRLF sequences followed by IMAP commands when a victim runs an application that passes attacker-controlled input to these methods.

4) Resource exhaustion (CVE-ID: CVE-2026-80212)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the resolv DNS resolution logic when processing malicious DNS responses from an attacker-controlled name server. A remote attacker can return crafted DNS responses that are retained permanently to cause a denial of service.

Only applications that resolve hostnames an attacker can influence through this gem are affected.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3668