The Ruby net-imap library's STARTTLS implementation improperly handles certain responses during TLS negotiation. Specifically, a man-in-the-middle attacker can inject a forged tagged OK response before the client completes the STARTTLS command, causing the client to believe TLS has been successfully established when it has not. This allows interception and modification of sensitive data transmitted over the connection. The vulnerability affects net-imap versions prior to 0.3.10, 0.4.24, 0.5.14, and 0.6.4. Red Hat's advisory confirms the issue affects their Ruby packages bundled with net-imap and provides patched versions. The attack complexity is high, requiring network interception and timing precision. Red Hat recommends switching to implicit TLS connections as a temporary mitigation.

Successful exploitation allows a man-in-the-middle attacker to bypass TLS encryption on IMAP connections that use STARTTLS, potentially exposing authentication credentials, email contents, and other sensitive information. It also enables unauthorized modification of data exchanged over the affected connection. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS v3.1 base score is 7.4 (high severity).

A fix is available in net-imap versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4 and corresponding patched Ruby packages from Red Hat. Users should apply these updates promptly. As a temporary workaround, users are strongly encouraged to switch from explicit TLS upgrading mechanisms (STARTTLS on port 143) to implicit TLS connections (IMAPS on port 993), which are not vulnerable to this attack vector. This mitigation bypasses the vulnerable STARTTLS negotiation entirely.