From 2480e5321989dc702efd31e5dd840182a0df898b Mon Sep 17 00:00:00 2001 From: Jan-Kazlouski-elastic Date: Mon, 3 Aug 2026 13:01:22 +0300 Subject: [PATCH] fix(deps): bump net-imap to 0.5.15 for CVE-2026-42257 Clears Critical CVE-2026-42257 (and CVE-2026-42245/42258/47240/47242/47241) by pinning above the fixed 0.5.15 line. Continues overriding JRuby's default gem. Part of https://github.com/elastic/search-team/issues/15476 Co-authored-by: Cursor --- Dockerfile | 4 ++-- Dockerfile.wolfi | 4 ++-- Gemfile | 7 ++++--- Gemfile.lock | 4 ++-- NOTICE.txt | 27 ++++----------------------- 5 files changed, 14 insertions(+), 32 deletions(-) diff --git a/Dockerfile b/Dockerfile index d3a1ff63..7bd2fdf1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,8 +31,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \ # Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl # 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime. -# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246): the default -# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.3.10 gem +# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default +# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem # from the Gemfile provides the fixed version at runtime. # Needs root as /opt/jruby is root-owned. USER root diff --git a/Dockerfile.wolfi b/Dockerfile.wolfi index 0236b668..810928b1 100644 --- a/Dockerfile.wolfi +++ b/Dockerfile.wolfi @@ -64,8 +64,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \ # Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl # 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime. -# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246): the default -# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.3.10 gem +# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default +# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem # from the Gemfile provides the fixed version at runtime. # Done in the builder stage, before /opt/jruby is copied into the runtime image. RUN rm -rf /opt/jruby/lib/ruby/stdlib/org/bouncycastle \ diff --git a/Gemfile b/Gemfile index 82a136e5..7e90a6e0 100644 --- a/Gemfile +++ b/Gemfile @@ -40,9 +40,10 @@ group :default do # JRuby 9.4.12.0's default jruby-openssl 0.15.3 ships the vulnerable 1.79. gem 'jruby-openssl', '0.16.0', platform: :jruby - # JRuby 9.4.12.0 ships net-imap 0.2.3 as a default gem (CVE-2026-42246 STARTTLS - # stripping). Pin the lowest fixed release so Bundler installs over the default. - gem 'net-imap', '0.3.10' + # JRuby 9.4.12.0 ships net-imap 0.2.3 as a default gem. Pin above the fixed + # lines for CVE-2026-42246 / CVE-2026-42257 / CVE-2026-42245 / CVE-2026-42258 + # / CVE-2026-47240 / CVE-2026-47242 / CVE-2026-47241 (0.5.15 clears all). + gem 'net-imap', '0.5.15' # Gems that need jruby as the platform gem 'bson', '~> 4.15.0', platform: :jruby diff --git a/Gemfile.lock b/Gemfile.lock index 8e44153a..041fdf02 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -68,7 +68,7 @@ GEM method_source (1.1.0) minitest (5.22.3) multi_json (1.15.0) - net-imap (0.3.10) + net-imap (0.5.15) date net-protocol net-protocol (0.2.2) @@ -184,7 +184,7 @@ DEPENDENCIES jruby-openssl (= 0.16.0) json (~> 2.7.2) json-schema (~> 4.3.0) - net-imap (= 0.3.10) + net-imap (= 0.5.15) nokogiri (~> 1.18.9) pry (~> 0.14.2) pry-nav diff --git a/NOTICE.txt b/NOTICE.txt index c8837de9..7c4c0ad3 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -1699,32 +1699,13 @@ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------------------- -Library: net-imap 0.3.10 +Library: net-imap 0.5.15 URL: https://github.com/ruby/net-imap License: Ruby OR BSD-2-Clause -Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions -are met: -1. Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. -2. Redistributions in binary form must reproduce the above copyright -notice, this list of conditions and the following disclaimer in the -documentation and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -SUCH DAMAGE. +All the files in this distribution are covered under either the Ruby license or +the BSD-2-Clause license (see the file COPYING) except some documentation mentioned +below. -------------------------------------------------------------------------