Ruby net-imap < 0.3.10 / 0.4.x < 0.4.24 / 0.5.x < 0.5.14 / 0.6.x < 0.6.4 vulnerability

#%NASL_MIN_LEVEL 80900
#
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(313279);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/19");

  script_cve_id("CVE-2026-42246");
  script_xref(name:"IAVB", value:"2026-B-0117");

  script_name(english:"Ruby net-imap < 0.3.10 / 0.4.x < 0.4.24 / 0.5.x < 0.5.14 / 0.6.x < 0.6.4 vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by a man-in-the-middle vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the net-imap Ruby library installed on the remote host is prior to 0.3.10, 0.4.x prior to 0.4.24, 0.5.x 
prior to 0.5.14, or 0.6.x prior to 0.6.4. It is, therefore, affected by a man-in-the-middle vulnerability.

A flaw in the Net::IMAP#starttls function allows a man-in-the-middle attacker to bypass the upgrade to an encrypted TLS
connection. By injecting a specially crafted response, the attacker can cause the library to proceed as if the command 
succeeded without actually establishing TLS encryption. This results in the socket remaining unencrypted, allowing for 
the interception of cleartext communications unless the client specifically verifies the encryption status.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version 
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-vcgp-9326-pqcp");
  script_set_attribute(attribute:"solution", value:
"Upgrade to net-imap version 0.3.10, 0.4.24, 0.5.14, or 0.6.4.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42246");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ruby:net-imap");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ruby_modules_nix_installed.nbin", "ruby_gem_modules_macos_installed.nbin", "ruby_modules_win_installed.nbin");
  script_require_keys("Host/ruby/modules/enumerated");

  exit(0);
}

include('ruby.inc');

var gem_name = 'net-imap';
var app_info = ruby_gems::get_app_info(app: gem_name);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, gem_name);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '0', 'max_version': '0.3.9', 'fixed_version': '0.3.10'},
  {'min_version': '0.4.0', 'max_version': '0.4.23', 'fixed_version': '0.4.24'},
  {'min_version': '0.5.0', 'max_version': '0.5.13', 'fixed_version': '0.5.14'},
  {'min_version': '0.6.0', 'max_version': '0.6.3', 'fixed_version': '0.6.4'}
];

vcf::check_version_and_report(
  app_info:app_info, 
  constraints:constraints, 
  severity:SECURITY_HOLE
);