Detections
Analytics
Alpine: multiple ruby-net-imap packages: security update to 0.5.15-r0
medium Tenable Self-Hosted Container Security Plugin ID 477543
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5
and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation
to prevent command injection. However, if a server does not support non-synchronizing literals, it may
still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without
support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line
and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or
more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria
for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for
#fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15. (CVE-2026-47240)
- Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5
and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent
CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker
can force the next command to be absorbed as a continuation of the first command. This will cause the
first command to eventually fail, but also prevents it from returning until another command is sent (from
another thread). That other command will not return until the connection is closed. This vulnerability is
fixed in 0.6.5 and 0.5.15. (CVE-2026-47241)
- Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5
and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are
correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While
Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a
list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an
attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.
(CVE-2026-47242)
Solution
Update the ruby-net-imap library and its related packages to version 0.5.15-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-47240
Plugin Details
Severity: Medium
ID: 477543
Version: Revision 1.2
Type: Local
Published: 10/27/2026
Updated: 10/27/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.49
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N
CVSS Score Source: CVE-2026-47242
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.4
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.8
Threat Score: 1.9
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 6/9/2026