https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:44:07 +0000 https://vulnerability.circl.lu/vuln/ghsa-hm49-wcqc-g2xg <p><strong>Affected:</strong> RubyGems: net-imap</p> <p>### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.</p> <p>### Details</p> <p>`Net::IMAP`&#39;s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection&#39;s UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.</p> <p>But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: * `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` * when `criteria` is a String, it is sent raw * `#uid_fetch`, `#fetch * when `attr` is a String, it is sent raw * when `attr` is an Array, each String in `attr` is sent raw * `#uid_store`, `#store` * when `attr` is a String, it is sent raw * `#setquota`: * `limit` is interpolated with `#to_s` and that string is sent raw</p> <p>Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.</p> <p>Using \&#34;raw data\&#34; arguments for `#uid_store`, `#sto…</p> <p><strong>Affected:</strong> RubyGems: net-imap</p> <p>### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.</p> <p>### Details</p> <p>`Net::IMAP`&#39;s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection&#39;s UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.</p> <p>But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: * `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` * when `criteria` is a String, it is sent raw * `#uid_fetch`, `#fetch * when `attr` is a String, it is sent raw * when `attr` is an Array, each String in `attr` is sent raw * `#uid_store`, `#store` * when `attr` is a String, it is sent raw * `#setquota`: * `limit` is interpolated with `#to_s` and that string is sent raw</p> <p>Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.</p> <p>Using \&#34;raw data\&#34; arguments for `#uid_store`, `#sto…</p> https://vulnerability.circl.lu/vuln/ghsa-hm49-wcqc-g2xg