Threats Tagged 'cve-2026-42246'

This update includes the following RPMs: ruby3.4: * ruby3.4-3.4.10-31.hum1 (aarch64, x86_64) * ruby3.4-bundled-gems-3.4.10-31.hum1 (aarch64, x86_64) * ruby3.4-default-gems-3.4.10-31.hum1 (noarch) * ruby3.4-devel-3.4.10-31.hum1 (aarch64, x86_64) * ruby3.4-doc-3.4.10-31.hum1 (noarch) * ruby3.4-libs-3.4.10-31.hum1 (aarch64, x86_64) * rubygem3.4-bigdecimal-3.1.8-31.hum1 (aarch64, x86_64) * rubygem3.4-bundler-2.6.9-31.hum1 (noarch) * rubygem3.4-devel-3.6.9-31.hum1 (noarch) * rubygem3.4-io-console-0.8.1-31.hum1 (aarch64, x86_64) * rubygem3.4-irb-1.14.3-31.hum1 (noarch) * rubygem3.4-json-2.9.1-31.hum1 (aarch64, x86_64) * rubygem3.4-minitest-5.25.4-31.hum1 (noarch) * rubygem3.4-power_assert-2.0.5-31.hum1 (noarch) * rubygem3.4-psych-5.2.2-31.hum1 (aarch64, x86_64) * rubygem3.4-racc-1.8.1-31.hum1 (aarch64, x86_64) * rubygem3.4-rake-13.2.1-31.hum1 (noarch) * rubygem3.4-rbs-3.8.0-31.hum1 (aarch64, x86_64) * rubygem3.4-rdoc-6.14.0-31.hum1 (noarch) * rubygem3.4-rexml-3.4.4-31.hum1 (noarch) * rubygem3.4-rss-0.3.1-31.hum1 (noarch) * rubygem3.4-rubygems-3.6.9-31.hum1 (noarch) * rubygem3.4-test-unit-3.6.7-31.hum1 (noarch) * rubygem3.4-typeprof-0.30.1-31.hum1 (noarch) * ruby3.4-3.4.10-31.hum1.src (src) Security Fix(es): ruby3.4: * CVE-2026-42245 * CVE-2026-42246 * CVE-2026-42256 * CVE-2026-47242

This update includes the following RPMs: ruby3.3: * ruby3.3-3.3.10-23.2.hum1 (aarch64, x86_64) * ruby3.3-bundled-gems-3.3.10-23.2.hum1 (aarch64, x86_64) * ruby3.3-default-gems-3.3.10-23.2.hum1 (noarch) * ruby3.3-devel-3.3.10-23.2.hum1 (aarch64, x86_64) * ruby3.3-doc-3.3.10-23.2.hum1 (noarch) * ruby3.3-libs-3.3.10-23.2.hum1 (aarch64, x86_64) * rubygem3.3-bigdecimal-3.1.5-23.2.hum1 (aarch64, x86_64) * rubygem3.3-bundler-2.5.22-23.2.hum1 (noarch) * rubygem3.3-devel-3.5.22-23.2.hum1 (noarch) * rubygem3.3-io-console-0.7.1-23.2.hum1 (aarch64, x86_64) * rubygem3.3-irb-1.13.1-23.2.hum1 (noarch) * rubygem3.3-json-2.7.2-23.2.hum1 (aarch64, x86_64) * rubygem3.3-minitest-5.20.0-23.2.hum1 (noarch) * rubygem3.3-power_assert-2.0.3-23.2.hum1 (noarch) * rubygem3.3-psych-5.1.2-23.2.hum1 (aarch64, x86_64) * rubygem3.3-racc-1.7.3-23.2.hum1 (aarch64, x86_64) * rubygem3.3-rake-13.1.0-23.2.hum1 (noarch) * rubygem3.3-rbs-3.4.0-23.2.hum1 (aarch64, x86_64) * rubygem3.3-rdoc-6.6.3.1-23.2.hum1 (noarch) * rubygem3.3-rexml-3.4.4-23.2.hum1 (noarch) * rubygem3.3-rss-0.3.1-23.2.hum1 (noarch) * rubygem3.3-rubygems-3.5.22-23.2.hum1 (noarch) * rubygem3.3-test-unit-3.6.1-23.2.hum1 (noarch) * rubygem3.3-typeprof-0.21.9-23.2.hum1 (noarch) * ruby3.3-3.3.10-23.2.hum1.src (src) Security Fix(es): ruby3.3: * CVE-2026-42245 * CVE-2026-42246 * CVE-2026-42256

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update includes the following RPMs: ruby3.4: * ruby3.4-3.4.8-31.2.hum1 (aarch64, x86_64) * ruby3.4-bundled-gems-3.4.8-31.2.hum1 (aarch64, x86_64) * ruby3.4-default-gems-3.4.8-31.2.hum1 (noarch) * ruby3.4-devel-3.4.8-31.2.hum1 (aarch64, x86_64) * ruby3.4-doc-3.4.8-31.2.hum1 (noarch) * ruby3.4-libs-3.4.8-31.2.hum1 (aarch64, x86_64) * rubygem3.4-bigdecimal-3.1.8-31.2.hum1 (aarch64, x86_64) * rubygem3.4-bundler-2.6.9-31.2.hum1 (noarch) * rubygem3.4-devel-3.6.9-31.2.hum1 (noarch) * rubygem3.4-io-console-0.8.1-31.2.hum1 (aarch64, x86_64) * rubygem3.4-irb-1.14.3-31.2.hum1 (noarch) * rubygem3.4-json-2.9.1-31.2.hum1 (aarch64, x86_64) * rubygem3.4-minitest-5.25.4-31.2.hum1 (noarch) * rubygem3.4-power_assert-2.0.5-31.2.hum1 (noarch) * rubygem3.4-psych-5.2.2-31.2.hum1 (aarch64, x86_64) * rubygem3.4-racc-1.8.1-31.2.hum1 (aarch64, x86_64) * rubygem3.4-rake-13.2.1-31.2.hum1 (noarch) * rubygem3.4-rbs-3.8.0-31.2.hum1 (aarch64, x86_64) * rubygem3.4-rdoc-6.14.0-31.2.hum1 (noarch) * rubygem3.4-rexml-3.4.4-31.2.hum1 (noarch) * rubygem3.4-rss-0.3.1-31.2.hum1 (noarch) * rubygem3.4-rubygems-3.6.9-31.2.hum1 (noarch) * rubygem3.4-test-unit-3.6.7-31.2.hum1 (noarch) * rubygem3.4-typeprof-0.30.1-31.2.hum1 (noarch) * ruby3.4-3.4.8-31.2.hum1.src (src) Security Fix(es): ruby3.4: * CVE-2026-42245 * CVE-2026-42246 * CVE-2026-42256

This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.0-33.4.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.0-33.4.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.0-33.4.hum1 (noarch) * ruby4.0-devel-4.0.0-33.4.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.0-33.4.hum1 (noarch) * ruby4.0-libs-4.0.0-33.4.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-33.4.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.3-33.4.hum1 (noarch) * rubygem4.0-devel-4.0.3-33.4.hum1 (noarch) * rubygem4.0-io-console-0.8.2-33.4.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-33.4.hum1 (noarch) * rubygem4.0-json-2.18.0-33.4.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-33.4.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-33.4.hum1 (noarch) * rubygem4.0-psych-5.3.1-33.4.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-33.4.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-33.4.hum1 (noarch) * rubygem4.0-rbs-3.10.0-33.4.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.3-33.4.hum1 (noarch) * rubygem4.0-rexml-3.4.4-33.4.hum1 (noarch) * rubygem4.0-rss-0.3.2-33.4.hum1 (noarch) * rubygem4.0-rubygems-4.0.3-33.4.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-33.4.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-33.4.hum1 (noarch) * ruby4.0-4.0.0-33.4.hum1.src (src) Security Fix(es): ruby4.0: * CVE-2026-42245 * CVE-2026-42246 * CVE-2026-42256 * CVE-2026-47240 * CVE-2026-47242

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.