🚨 [security] Update mail 2.7.0 → 2.9.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ mail (indirect, 2.7.0 → 2.9.1) · Repo · Changelog

Security Advisories 🚨

🚨 Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary

Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.

Details

Both decoders used a single String#match against a pattern such as /=?(.+)??[Qq]?(.*)?=/m. Two problems:

1. Single match, dropped remainder. Only the first =?charset?Q?...?= (or ?B?) word was decoded. Any additional encoded-words or surrounding text were not handled consistently, so the decoded result could silently omit or alter parts of the input.
2. Greedy charset capture. (.+)? is greedy and matches across ? delimiters, so a malformed word could span more of the string than a strict RFC 2047 parse would, changing the boundary between "encoded" and "literal" text.

Impact

Applications using mail to parse and display or authorize based on decoded header values (From, To, Reply-To, etc.) may present or act on an address different from the one a validator inspecting the raw header would see. Primary risk is spoofing / phishing and authorization-check bypass. No RCE.

Release Notes

2.9.1

What's Changed

• Add Ruby 3.4 to CI matrix in GitHub Actions workflow by @ydah in #1653

• Improve decoding of Q- and B-encoded strings by @radar in #1664

• Bump to 2.9.1 by @radar in #1665

• @ydah made their first contribution in #1653

Full Changelog: 2.9.0...2.9.1

2.9.0

What's Changed

• Fix little typo by @nbennke in #1462
• 2.8.0.rc1 Regression: Preserve message-level charset when adding parts (related to Rails ActionMailer) by @johnnyshields in #1495
• Use Rake's default rakelib/ directory by @olleolleolle in #1488
• refactor: Use Dir.glob only once in gemspec's "files" directive by @olleolleolle in #1486
• Configure RSpec's zero-monkey patching mode by @olleolleolle in #1485
• Remove unnecessary gemfile dependency on strscan by @deivid-rodriguez in #1483
• README: sending multipart mail by @kapfenho in #1479
• Add delivery_interceptors method to Mail class to fetch registered interceptors by @ghousemohamed in #1475
• Update MIME-Version to have correct case per the RFC by @mikel in #1503
• Adding explicit JRuby support by @mikel in #1508
• refactor: Use Ruby 2's dir where possible by @olleolleolle in #1487
• [Corrected] Layout/TrailingWhitespace: Trailing whitespace detected. by @mikel in #1510
• Improve documentation by @fwolfst in #1371
• Span => Spam by @sebbASF in #1320
• use unpack1 by @ahorek in #1513
• Lazy-load fields and elements by @c960657 in #1491
• Install libyaml-dev for Psych by @c960657 in #1522
• Feature/parse lf by @sebbASF in #1520
• use match? by @ahorek in #1514
• Bump actions/checkout to v3 by @sebbASF in #1535
• Fix for #1527 by @sebbASF in #1534
• Standardise on WARNING: prefix by @sebbASF in #1533
• Checks are in the wrong place by @sebbASF in #1531
• Allow manual trigger by @sebbASF in #1524
• Handle parsing of LF-only body with separate parts by @mikel in #1511
• Make activesupport gem optional by @sebbASF in #1532
• SMTP: refactor and accept starttls :always and :auto by @eval in #1536
• Adds Ruby 3.2 to the CI matrix by @petergoldstein in #1552
• Layout conventions are not the same as syntax by @sebbASF in #1558
• Don't shadow local variable by @sebbASF in #1318
• Revert PR #1495 because it is a dupe of #1470 by @johnnyshields in #1559
• Add Ruby 3.3 to CI matrix by @m-nakamura145 in #1595
• TruffleRuby is flaky by @sebbASF in #1599
• Use require_relative where possible by @eval in #1598
• Test string is 1 char short of 78 by @sebbASF in #1568
• Update documentation regarding errors array by @mikehale in #1605
• Fix all 'assigned but unused variable' warnings by @skipkayhil in #1551
• Fix IMAP search issues by @nevans in #1611
• Document SMTP TLS/STARTTLS settings (cherry-picked from 2.8 stable branch) by @nevans in #1613
• CI: Use checkout@v4 by @olleolleolle in #1616
• Drop unused "ad hoc" GH Actions workflow by @olleolleolle in #1615
• include rfc822 as attachments by @ahorek in #1389
• Address warning: URI::RFC3986_PARSER warnings by @yahonda in #1620
• Add logger as a dependency for Ruby 3.4 warnings by @yahonda in #1619
• Fix regression in content_type for text part after converted to multipart by @jeremyevans in #1330

New Contributors

• @nbennke made their first contribution in #1462
• @johnnyshields made their first contribution in #1495
• @kapfenho made their first contribution in #1479
• @ghousemohamed made their first contribution in #1475
• @petergoldstein made their first contribution in #1552
• @mikehale made their first contribution in #1605
• @skipkayhil made their first contribution in #1551

Full Changelog: 2.8.1...2.9.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mini_mime (indirect, 1.0.1 → 1.1.5) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 43 commits:

• Update mime types from upstream and bump
• Version bump
• Handle MIME::Types differences on Windows
• Shim IO#pread when not supported
• Version bump
• Make the library fork safe and drop the mutex
• DB updates 2023-03-01T10:03:17Z (#49)
• Adds Ruby 3.2 to the CI matrix. Requires Ruby >= 2.6. (#48)
• DEV: Require ruby >= 2.5 (#46)
• DEV: Update gem description to match repo desc (#47)
• DB updates 2022-01-06T11:58:07Z (#45)
• Update CI config (#42)
• Add Ruby 3.0 to CI (#40)
• version bump
• DB updates 2021-10-01T10:15:26Z
• version bump and changelog
• DB updates 2021-08-01T10:14:51Z
• DEV: Allow recent versions of gems in development
• version bump
• FEATURE: perform case insensitive lookups
• Update ci.yml (#35)
• Version bump and database update
• Rebuild DBs to fix specs
• Update mime-types-data before rebuilding DB
• Abort if steps fail in automated DB update
• Simplify gem caching for build job
• Automate DB updates with scheduled GH Action
• Update to the latest mime-types-data (#31)
• DEV: Switch from Travis to Actions (#29)
• List .lookup_by_extension in the README (#28)
• Changelog and prepare for release
• FEATURE: update for latest parity with mime types data
• Remove unsupported rubies from travis test matrix
• relax bundler version
• Update benchmark in readme
• Add gems to Gemfile for bench script
• Allow custom db paths
• Update benchmark
• Test on Ruby 2.5 and Ruby 2.6
• Merge pull request #16 from Aqualon/readme_improvements
• Fix some typos/whitespace
• Fix link to bench.rb
• bump cache on travis

🆕 date (added, 3.5.1)

🆕 logger (added, 1.7.0)

🆕 mini_portile2 (added, 2.8.9)

🆕 net-imap (added, 0.6.6)

🆕 net-pop (added, 0.1.2)

🆕 net-protocol (added, 0.3.0)

🆕 net-smtp (added, 0.5.1)

🆕 timeout (added, 0.6.1)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)