Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Ruby 3.4 Update Fixes Security Risks in IMAP and URI Handling
published 3 months ago
Summary
This update addresses security issues in Ruby 3.4, including the potential for attackers to inject malicious commands or access sensitive user credentials. Affected users should update to Ruby 3.4.10 to ensure their system remains secure. The update includes fixes for issues that could lead to denial of service or command injection attacks via the IMAP protocol and URI handling.
What to do
- Update suse ruby3.4 to version 3.4.10-150700.3.4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | suse | ruby3.4 |
< 3.4.10-150700.3.4.1 Fix: upgrade to 3.4.10-150700.3.4.1
|
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | suse | ruby3.4 |
< 3.4.10-150700.3.4.1 Fix: upgrade to 3.4.10-150700.3.4.1
|
Original advisory text
Security update for ruby3.4
This update for ruby3.4 fixes the following issues
- CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments (bsc#1268011).
- CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in 'raw' argument (bsc#1268337).
- CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).
- CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).
- CVE-2025-61594: merging URIs using the + operator could expose sensitive user credentials (bsc#1270034).
Changes for ruby3.4:
- Update to 3.4.10:
- bundling net-imap 0.5.15.
- CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments (bsc#1268011).
- CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in 'raw' argument (bsc#1268337).
- CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).
- CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).
- CVE-2025-61594: merging URIs using the + operator could expose sensitive user credentials (bsc#1270034).
Changes for ruby3.4:
- Update to 3.4.10:
- bundling net-imap 0.5.15.
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20263090-1/ Vendor Advisory
- https://bugzilla.suse.com/1268011 Third Party Advisory
- https://bugzilla.suse.com/1268337 Third Party Advisory
- https://bugzilla.suse.com/1268338 Third Party Advisory
- https://bugzilla.suse.com/1268339 Third Party Advisory
- https://bugzilla.suse.com/1270034 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2025-61594 URL
- https://www.suse.com/security/cve/CVE-2026-42258 URL
- https://www.suse.com/security/cve/CVE-2026-47240 URL
- https://www.suse.com/security/cve/CVE-2026-47241 URL
- https://www.suse.com/security/cve/CVE-2026-47242 URL
Timeline
Published17 Jul 2026
Updated18 Jul 2026
First seen18 Jul 2026
Sources
SUSE-SU-2026:3090-1 · OSV
Track software like this
Free during beta