CHEF-35182 ruby net-imap - #4227
Open
lbakerchef wants to merge 2 commits into
Open
Conversation
lbakerchef
added
the
ai-assisted
lbakerchef
force-pushed
the
CHEF-33469/lbaker
branch
4 times, most recently
from
August 4, 2026 20:46
80d3c69 to
c69aed4
Compare
Add explicit rack/rexml version floors to the three Gemfiles here
that pull in chef and/or chef-zero (chef-server-ctl, oc-id,
oc-chef-pedant), sourced dynamically from the same
SafeVersions::MINIMUM_SAFE_RACK_VERSION / MINIMUM_SAFE_REXML_VERSION
constants that ruby_gems_cleanup.rb enforces on upgrade, reached via
the omnibus/ submodule's libraries/safe_versions.rb (bumped in the
prior commit). This makes the safety floor a single source of
truth instead of two independently maintained values that can
drift apart.
- src/chef-server-ctl/Gemfile: new rack + rexml floors (had none).
- src/oc-id/Gemfile: replaced the previous static
`gem 'rack', '>= 3.2.4'` with the dynamic floor; added a new
rexml floor (had none).
- oc-chef-pedant/Gemfile: new rack floor only (rexml isn't in its
resolved dependency graph).
Each Gemfile wraps the require_relative in begin/rescue LoadError
and fails open (warns, defaults to no floor) if the submodule isn't
checked out or the file can't otherwise be reached, or if the
expected constants aren't defined/are blank -- so a developer who
hasn't run `git submodule update --init` still gets a working
`bundle install`, just without the extra floor enforced. A genuine
bug in safe_versions.rb's own Ruby (syntax error, etc.) is not
swallowed and will still fail the build loudly, by design.
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
extend oc-id's rack/rexml Gemfile floor pattern to net-imap (CHEF-35182)
Add a net-imap version floor to oc-id's Gemfile using the same
resolve_safe_version.call(:CONSTANT) pattern already used for
rack/rexml, sourced from omnibus-config's safe_versions.rb (the
same file ruby_gems_cleanup.rb enforces on upgrade):
gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}"
net-imap isn't a direct oc-id dependency -- it's pulled in
transitively via mail -- but CVE-2025-XXXXX (net-imap response
injection) affects versions below 0.5.14 (Ruby < 3.2) or 0.6.4
(Ruby >= 3.2). NET_IMAP_FIX_VERSION resolves to whichever floor
applies to the Ruby this Gemfile is bundled under, so `bundle
install` refuses to resolve a vulnerable net-imap regardless of
what mail or any other dependency would otherwise pull in.
Comment updated to mention net-imap alongside rack/rexml and to
point at NET_IMAP_FIX_VERSION specifically, since (unlike the
rack/rexml floors) it's a computed value rather than a fixed one --
see safe_versions.rb for why.
Companion change in chef-server-omnibus-config (commit f38c231,
"extend safe-versions floors to net-imap") adds the
NET_IMAP_FIX_VERSION_0_4/_0_5/_0_6 constants, the generic
NET_IMAP_FIX_VERSION resolution, and generalizes ruby_gems_cleanup.rb's
vulnerable-gem sweep to cover net-imap; that repo's submodule
pointer is bumped in a separate commit here.
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
lbakerchef
force-pushed
the
CHEF-33469/lbaker
branch
2 times, most recently
from
August 8, 2026 01:45
30ad600 to
7932967
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR resolves the net-imap CVE cleanup gap, where the vulnerable net-imap default gem (bundled with Ruby itself, e.g. 0.2.4) was left on disk indefinitely after an upgrade because it isn't managed by any app's Gemfile.lock and the existing rack/rexml-style version-threshold cleanup couldn't detect it. SafeVersions now exposes a NET_IMAP_FIX_VERSION-driven net_imap_vulnerable? check (rather than a flat minimum-version constant) so ruby_gems_cleanup.rb can correctly identify and remove the vulnerable default gem, and oc-id's Gemfile -- the app that directly depends on net-imap -- enforces the same floor via the shared resolve_safe_version mechanism.
Extract the minimum safe rack/rexml versions used by ruby_gems_cleanup.rb into a new libraries/safe_versions.rb, so there is exactly one place these versions are declared instead of two independently-maintained copies.
chef-server's Gemfiles (chef-server-ctl, oc-id, oc-chef-pedant) require_relative this same file via the omnibus/ submodule, so their rack/rexml floors stay tied to this single source too.