HCL BigFix Compliance (Ruby): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 7.6
  CVE-2026-42246

  net-imap vulnerable to STARTTLS stripping via invalid response timing

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issu…

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 6.9
  CVE-2026-41493

  yard: Possible arbitrary path traversal and file access via yard server

  YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard …

  lsegal yard yard yard Debian Ubuntu RubyGems
  May 8, 2026
• Medium 6.0
  CVE-2026-42256

  net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile ser…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 5.8
  CVE-2026-42257

  net-imap: Command Injection via "raw" arguments to multiple commands

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this …

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 5.8
  CVE-2026-42258

  net-imap: Command Injection via unvalidated Symbol inputs

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMA…

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Low 2.3
  CVE-2026-42245

  net-imap: Quadratic complexity when reading response literals

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hos…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026

Revision history

1. 2026-11-08 #12

   Neue Updates von Debian aufgenommen

2. 2026-09-30 #11

   Neue Updates von Oracle Linux aufgenommen

3. 2026-09-29 #10

   Neue Updates von Oracle Linux aufgenommen

4. 2026-09-24 #9

   Neue Updates von openSUSE aufgenommen

5. 2026-08-26 #8

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

6. 2026-08-16 #7

   Neue Updates von Oracle Linux aufgenommen

7. 2026-08-10 #6

   Neue Updates von Oracle Linux aufgenommen

8. 2026-08-09 #5

   Neue Updates von Oracle Linux aufgenommen

9. 2026-08-04 #4

   Neue Updates von Red Hat aufgenommen

10. 2026-07-06 #3

    Neue Updates von Oracle Linux aufgenommen

11. 2026-06-30 #2

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

12. 2026-06-28 #1

    Initiale Fassung

References

• HCL Security Bulletin vom 2026-06-28
  https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131659
• HCL Security Bulletin vom 2026-06-28
  https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131663
• Red Hat Security Advisory RHSA-2026:33630 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33630
• Red Hat Security Advisory RHSA-2026:33540 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33540
• Red Hat Security Advisory RHSA-2026:33515 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33515
• Rocky Linux Security Advisory RLSA-2026:33577 vom 2026-07-01
  https://errata.build.resf.org/RLSA-2026:33577
• Red Hat Security Advisory RHSA-2026:33514 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33514
• Rocky Linux Security Advisory RLSA-2026:33576 vom 2026-07-01
  https://errata.build.resf.org/RLSA-2026:33576
• Red Hat Security Advisory RHSA-2026:33551 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33551
• Rocky Linux Security Advisory RLSA-2026:33515 vom 2026-06-30
  https://errata.build.resf.org/RLSA-2026:33515
• Red Hat Security Advisory RHSA-2026:33552 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33552
• Rocky Linux Security Advisory RLSA-2026:33514 vom 2026-06-30
  https://errata.build.resf.org/RLSA-2026:33514
• Red Hat Security Advisory RHSA-2026:33565 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33565
• Red Hat Security Advisory RHSA-2026:33512 vom 2026-06-30
  https://access.redhat.com/errata/RHSA-2026:33512
• Red Hat Security Advisory RHSA-2026:33721 vom 2026-07-01
  https://access.redhat.com/errata/RHSA-2026:33721
• Oracle Linux Security Advisory ELSA-2026-33577 vom 2026-07-07
  https://linux.oracle.com/errata/ELSA-2026-33577.html
• Oracle Linux Security Advisory ELSA-2026-33515 vom 2026-07-07
  http://linux.oracle.com/errata/ELSA-2026-33515.html
• Red Hat Security Advisory RHSA-2026:50728 vom 2026-08-05
  https://access.redhat.com/errata/RHSA-2026:50728
• Oracle Linux Security Advisory ELSA-2026-50828 vom 2026-08-10
  https://linux.oracle.com/errata/ELSA-2026-50828.html
• Oracle Linux Security Advisory ELSA-2026-50728 vom 2026-08-10
  https://linux.oracle.com/errata/ELSA-2026-50728.html
• Oracle Linux Security Advisory ELSA-2026-37397 vom 2026-08-11
  https://linux.oracle.com/errata/ELSA-2026-37397.html
• Oracle Linux Security Advisory ELSA-2026-50778 vom 2026-08-15
  https://oss.oracle.com/pipermail/el-errata/2026-August/021590.html
• Oracle Linux Security Advisory ELSA-2026-50773 vom 2026-08-15
  https://oss.oracle.com/pipermail/el-errata/2026-August/021589.html
• Rocky Linux Security Advisory RLSA-2026:50828 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50828
• Rocky Linux Security Advisory RLSA-2026:50827 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50827
• Rocky Linux Security Advisory RLSA-2026:50778 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50778
• Rocky Linux Security Advisory RLSA-2026:50773 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50773
• Rocky Linux Security Advisory RLSA-2026:50728 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50728
• openSUSE Security Update OPENSUSE-SU-2026:21878-1 vom 2026-09-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H5GSEWRBRK6T2WY5GOLRFYLYEV6CKJXW/
• Oracle Linux Security Advisory ELSA-2026-72484 vom 2026-09-29
  https://linux.oracle.com/errata/ELSA-2026-72484.html
• Oracle Linux Security Advisory ELSA-2026-72485 vom 2026-09-29
  https://linux.oracle.com/errata/ELSA-2026-72485.html
• Oracle Linux Security Advisory ELSA-2026-72285 vom 2026-09-30
  https://linux.oracle.com/errata/ELSA-2026-72285.html
• Debian Security Advisory DSA-6614 vom 2026-11-07
  https://lists.debian.org/debian-security-announce/2026/msg00533.html