Kazuki Yamaguchi

2 exploits Active since Jan 2017

CVE-2026-42246 WRITEUP HIGH WRITEUP

net-imap vulnerable to STARTTLS stripping via invalid response timing

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.

CVSS 7.4

View Code

CVE-2016-7798 WRITEUP HIGH WRITEUP

openssl < 2.0.0 - Inadequate Encryption Strength in GCM Mode

The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.

CVSS 7.5

View Code