| Package | Affected versions | Patched versions |
|---|---|---|
| net-imap | ≥ 0.4.0, < 0.4.24≥ 0.5.0, < 0.5.14≥ 0.6.0, < 0.6.4< 0.3.10 | 0.4.240.5.140.6.40.3.10 |
| net | ≥ 0.4.0, < 0.4.24≥ 0.5.0, < 0.5.14≥ 0.6.0, < 0.6.4< 0.3.10 | 0.4.240.5.140.6.40.3.10 |
A man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.
When using Net::IMAP#starttls to upgrade a plaintext connection to use TLS, a man-in-the-middle attacker can inject a tagged OK response with an easily predictable tag. By sending the response before the client finishes sending the command, the command completes "successfully" before the response handler is registered. This allows #starttls to return without error, but the response handler is never invoked, the TLS connection is never established, and the socket remains unencrypted.
This allows man-in-the-middle attackers to perform a STARTTLS stripping attack, unless the client code explicitly checks Net::IMAP#tls_verified?.
TLS bypass, leading to cleartext transmission of sensitive information.
#starttls does not establish TLS.STARTTLS with a cleartext port.
This is strongly recommended anyway:
Net::IMAP#tls_verified? is true, before using the connection after #starttls.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free