build(deps): bump net-imap from 0.3.9 to 0.4.24 in /appengine/rails-cloudsql-mysql

[dependabot]

Bumps net-imap from 0.3.9 to 0.4.24.

Release notes

Sourced from net-imap's releases.

v0.4.24

[!IMPORTANT] The 0.4.x release branch will only receive critical security fixes, and will be unsupported when ruby 3.3 is EOL. Please upgrade to a newer version.

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

[!WARNING] ruby/net-imap#666 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp). Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

[!IMPORTANT] Argument validation is significantly improved. Several injection vulnerabilities have been fixed: ruby/net-imap#663 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px). ruby/net-imap#663 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg) ruby/net-imap#663 fixes CRLF/command/argument injection via the storage_limit argument to #setquota (GHSA-hm49-wcqc-g2xg). ruby/net-imap#663 fixes CRLF/command injection via RawData (GHSA-hm49-wcqc-g2xg):

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String. When attr is an Array, its String members are sent as raw data.

[!CAUTION] RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

[!NOTE] Two denial of service vulnerabilities have been addressed. These are generally only relevant when connecting to an untrusted hostile server (or without TLS).

ruby/net-imap#651 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw). ruby/net-imap#655 adds a configurable max_iterations count for SCRAM-* authentication (GHSA-87pf-fpwv-p7m7).

The default ScramAuthenticator#max_iterations is 2**31 - 1 (max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.

Added

• 🔒 Add ScramAuthenticator#max_iterations (backports #654) in ruby/net-imap#655, reported by @​Masamuneee

Fixed

• 🔒 Fix STARTTLS stripping vulnerability (backports #664) in ruby/net-imap#666, reported by @​Masamuneee
• 🔒 Fix CRLF injection vulnerabilities (backports #657, #658, #659, #660, #636, #661) in ruby/net-imap#663, reported by @​manunio
• ⚡ Much faster ResponseReader performance (backports #642) in ruby/net-imap#651, reported by @​Masamuneee
• 🐛 Wait to continue RawData literals (backports #660) by @​nevans in ruby/net-imap#663

Other Changes

• ♻️ Improve internal literal sending (partially backports #358, #616, #649) by @​nevans in ruby/net-imap#653

Full Changelog: ruby/net-imap@v0.4.23...v0.4.24

... (truncated)

Commits

• 24a4e77 🔀 Merge pull request #666 from ruby/backport/v0.4/STARTTLS-stripping
• 63f53ff 🔖 Bump version to 0.4.24
• 038ae35 🍒 pick 24d5c773d: 🔒🥅 Handle tagged "OK" to incomplete command [backport #664]
• 705aa59 🍒 pick 62eea6ffe: 🔒🥅 Ensure STARTTLS tagged response was handled [backport #664]
• c9a6f28 🍒 pick 46636cae8: ❌🔒 Add failing test for STARTTLS stripping [backport #664]
• aec0699 🔀 Merge pull request #663 from ruby/backport/v0.4/raw_data-warnings
• fd245dd 🍒 pick be32e712e: 📚 Improve documentation of RawData arguments [backports #661]
• 6dd110b 🍒 pick 47c72186d: 🐛 Validate RawData and wait to continue literals [backports...
• 4e93149 🔀 Merge branch 'backport/v0.4/QUOTA-argument-validation' into backport/v0.4/s...
• d2b2360 🍒 pick 0ec4fd351: 🥅 Validate #setquota storage limit argument [backports #659]
• Additional commits viewable in compare view

[dependabot]

Superseded by #1829.