Skip to content

Translate "CVE-2025-43857"(zh_cn) #3562

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 5, 2025
Merged

Translate "CVE-2025-43857"(zh_cn) #3562

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions zh_cn/news/_posts/2025-04-28-dos-net-imap-cve-2025-43857.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
---
layout: news_post
title: "CVE-2025-43857: net-imap 中的 DoS 漏洞"
author: "nevans"
translator: "GAO Jun"
date: 2025-04-28 16:02:04 +0000
tags: security
lang: zh_cn
---

在 `net-imap` gem 中存在一个可能造成 DoS 的漏洞。此漏洞的 CVE 编号为 [CVE-2025-43857]。我们建议您更新 `net-imap` gem。

## 详情

恶意服务器可以发送一个 “特定的” 字节数信息，这个数字会被客户端的接收线程自动读取。
读取后，客户端会立即根据服务器告知的这个字节数分配内存。在安全地连接可信 IMAP 服务器时，这不是一个问题。
但当使用不安全连接，或连接到有缺陷、不可信或已被入侵的服务器（例如，连接到用户提供的主机名）时，就可能导致 DoS。

请将 `net-imap` gem 更新到 0.2.5、0.3.9、0.4.20、0.5.7 或更高版本。

当连接不可信的服务器或使用不安全连接时，必须适当设置 `max_response_size` 参数，并在响应处理中进行适当调整以限制内存消耗。
更多详细信息请参阅 [GHSA-j3g3-5qv5-52mj]。

## 受影响版本

`net-imap` gem 版本 <= 0.2.4，0.3.0 至 0.3.8，0.4.0 至 0.4.19，以及 0.5.0 至 0.5.6。

## 致谢

感谢 [Masamune] 发现此问题。

## 历史

* 最初发布于 2025-04-28 16:02:04 (UTC)

[CVE-2025-43857]: https://www.cve.org/CVERecord?id=CVE-2025-43857
[GHSA-j3g3-5qv5-52mj]: https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj
[Masamune]: https://hackerone.com/masamune_
Loading