Bug #21130: Update net-imap for ruby 3.2, 3.3, 3.4

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.1: UNKNOWN, 3.2: DONE, 3.3: DONE, 3.4: DONE

[nevans (Nicholas Evans)]

The bundled versions are vulnerable to CVE-2024-25186 (GHSA-7fc5-f82f-cx69). Fixing the issue requires upgrading to v0.3.8, v0.4.19, or v0.5.4.

• ruby 3.2.7 bundles net-imap v0.3.4.1
  PR: Bump net-imap to 0.3.8 for Ruby 3.2
  https://github.com/ruby/ruby/pull/12733
• ruby 3.3.7 bundles net-imap v0.4.9.1
  PR: Bump net-imap to 0.4.19 for Ruby 3.3
  https://github.com/ruby/ruby/pull/12732
• ruby 3.4.1 bundles net-imap v0.5.4
  PR: Bump net-imap to v0.5.6 for Ruby 3.4
  https://github.com/ruby/ruby/pull/12731

The workaround is to uninstall the vulnerable bundled versions and gem install net-imap.

Security Advisory Links:

• https://www.cve.org/CVERecord?id=CVE-2025-25186
• https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69

[nevans (Nicholas Evans)]

• Description updated (diff)

[hsbt (Hiroshi SHIBATA)]

• Status changed from Open to Closed
• Backport changed from 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN to 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: REQUIRED, 3.4: REQUIRED

[k0kubun (Takashi Kokubun)]

• Backport changed from 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: REQUIRED, 3.4: REQUIRED to 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: REQUIRED, 3.4: DONE

ruby_3_4 12c716eea02f0efbb7dcd4ddb3a8b0523cdb99c2.

[hsbt (Hiroshi SHIBATA)]

• Backport changed from 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: REQUIRED, 3.4: DONE to 3.1: UNKNOWN, 3.2: DONE, 3.3: DONE, 3.4: DONE