The Ruby net-imap library's Net::IMAP#starttls method improperly handles certain responses during the STARTTLS negotiation, allowing a man-in-the-middle attacker to inject a predicted tagged OK response before the client completes the STARTTLS command. This causes the method to return success without actually establishing a TLS session, leaving the connection unencrypted and vulnerable to interception and modification. The vulnerability affects versions prior to 0.3.10, 0.4.24, 0.5.14, and 0.6.4 and has been patched in these versions. Exploitation complexity is high due to the need to intercept and modify network traffic and win a timing race. Red Hat has issued advisories and updates for affected products, including Red Hat Enterprise Linux 7 Extended Lifecycle Support. Temporary mitigation includes switching to implicit TLS connections on port 993, which bypasses the vulnerable STARTTLS negotiation path.

Successful exploitation allows an attacker capable of man-in-the-middle interception to bypass TLS encryption during the STARTTLS upgrade, causing sensitive information such as authentication credentials and email contents to be transmitted in cleartext. This also enables unauthorized modification of data exchanged over the affected connection. The vulnerability impacts confidentiality and integrity but does not affect availability. The attack complexity is high, requiring network interception and precise timing.

A fix is available in net-imap versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4 and later. Users should upgrade to these patched versions to remediate the vulnerability. As a temporary workaround, it is strongly recommended to avoid using STARTTLS on port 143 and instead use implicit TLS connections (IMAPS) on port 993, which are not vulnerable to this attack vector. Red Hat has released security updates for affected Ruby packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply these updates promptly.