Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the mail gem because two utility functions, Mail::Utilities.b_value_decode and Mail::Utilities.q_value_decode, used an overly greedy regular expression with String#match. This caused the functions to only process the first RFC 2047 encoded-word in a string, mishandling any subsequent encoded words or surrounding text. A malicious actor could craft an email address where the display name or local-part contains a malformed encoded-word. This would cause the decoded value (e.g., the From or To address) to differ from the raw value that a user or another mail parser might see. This discrepancy could be exploited for sender/recipient spoofing, phishing attacks, or to bypass authorization checks that rely on parsing these email headers. The patch replaces the single, greedy match with a call to gsub, which correctly finds and replaces all occurrences of encoded-words in the string, thus ensuring the entire string is decoded properly and eliminating the parsing discrepancy.
Mail::Utilities.b_value_decodelib/mail/utilities.rb
Mail::Utilities.q_value_decodelib/mail/utilities.rb
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rubygems | < 2.9.1 | 2.9.1 |