SB20261109147 - Anolis OS update for ruby:3.3 module

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109147

SB20261109147 - Anolis OS update for ruby:3.3 module

Published: November 9, 2026

Security Bulletin ID SB20261109147
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-42245)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust a net-imap client's CPU and cause a denial of service.

The vulnerability exists due to quadratic processing in Net::IMAP::ResponseReader when repeated scans of a growing response buffer process many string literals. An unauthenticated remote attacker can send crafted responses from a hostile IMAP server to a connected client, causing excessive CPU consumption even below the default max_response_size limit.


2) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-42246)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated network attacker to bypass TLS and expose sensitive information transmitted by an IMAP client.

The vulnerability exists due to net-imap accepting an early success response during a STARTTLS upgrade of a plaintext connection without ensuring TLS is established. An unauthenticated network attacker can intercept the connection and inject a predictably tagged response before the command finishes, leaving subsequent traffic unencrypted when the client does not explicitly verify TLS.


3) Command injection (CVE-ID: CVE-2026-42258)

CWE-ID: CWE-77 - Command injection

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to inject IMAP commands and delete mailboxes when a user triggers a vulnerable application command.

The vulnerability exists due to missing validation of Symbol arguments in net-imap when applications pass user-controlled input as Symbols to IMAP commands. An unprivileged local attacker can include CRLF sequences in a Symbol to terminate the original command and append a mailbox deletion command.


Remediation

Install update from vendor's website.

References