Skip to content

Translate 2025-04-28 DoS net-imap CVE news (zh_tw) #3564

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 4, 2025
Merged

Translate 2025-04-28 DoS net-imap CVE news (zh_tw) #3564

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions zh_tw/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
---
layout: news_post
title: "CVE-2025-43857: net-imap DoS 漏洞"
author: "nevans"
translator: "Bear Su"
date: 2025-04-28 16:02:04 +0000
tags: security
lang: zh_tw
---

在 net-imap gem 發現可能會造成 DoS 的漏洞。

該漏洞的 CVE 編號為 [CVE-2025-43857]。

我們建議您升級 net-imap gem。

## 風險細節

一個惡意伺服器可以發送一個會自動被客戶端的接收者執行緒讀取的 "literal" 位元組大小。

客戶端的接收者會立即為伺服器回應中指示的位元組大小分配記憶體。

在正確使用安全連接到受信任的 IMAP 伺服器時不會造成問題。

這只會影響到不安全的連接和有錯誤的、不受信任的或被攻擊的伺服器（例如，連接到使用者提供的主機名稱）。

請升級 net-imap gem 至版本 0.2.5、0.3.9、0.4.20、0.5.7、或更新版本。

當連接至不受信任的伺服器或使用不安全的連接時，`max_response_size` 和回應處理必須適當配置以限制記憶體使用量。請參見 [GHSA-j3g3-5qv5-52mj] 來了解更多。

## 受影響版本

net-imap gem 版本 <= 0.2.4、0.3.0 至 0.3.8、0.4.0 至 0.4.19、和 0.5.0 至 0.5.6。

## 致謝

感謝 [Masamune] 發現此問題。

## 歷史

* 最初發布於 2025-04-28 16:02:04 (UTC)

[CVE-2025-43857]: https://www.cve.org/CVERecord?id=CVE-2025-43857
[GHSA-j3g3-5qv5-52mj]: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
[Masamune]: https://hackerone.com/masamune_
Loading