Back Linuxsecurity

Ubuntu 18.04 Ruby Security Advisory USN-8431

Linuxsecurity •LinuxSecurity Advisories • June 16, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Ruby could allow unintended access to network services. Software Description: - ruby2.5: Object-oriented scripting language - ruby2.3: Object-oriented scripting language Details: It was discovered that Ruby's Net::IMAP library did not properly verify that Transport Layer Security (TLS) encryption was started after issuing a STARTTLS command. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and silently bypass TLS encryption. (CVE-2026-42246) It was also discovered that Ruby's Net::IMAP library did not validate string arguments passed to certain commands. A remote attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-42257)

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS libruby2.5 2.5.1-1ubuntu1.16+esm8 Available with Ubuntu Pro ruby2.5 2.5.1-1ubuntu1.16+esm8 Available with Ubuntu Pro Ubuntu 16.04 LTS libruby2.3 2.3.1-2~ubuntu16.04.16+esm14 Available with Ubuntu Pro ruby2.3 2.3.1-2~ubuntu16.04.16+esm14 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-42246, CVE-2026-42257

Ubuntu Security Notice USN-8431-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ruby IMAP Library Vulnerabilities Expose Users to MITM Attacks Two critical vulnerabilities were discovered in Ruby's Net::IMAP library affecting Ubuntu 18.04 and 16.04 LTS. CVE-2026-42246 allows remote attackers to perform machine-in-the-middle attacks by bypassing TLS encryption. CVE-2026-42257 enables attackers to inject arbitrary IMAP commands due to improper validation of string arguments. These vulnerabilities could lead to unauthorized access to network services. Affected users are urged to update their systems to mitigate risks. The vulnerabilities were published on May 9, 2026, and are currently being addressed through standard system updates. Ubuntu Pro users have access to long-term security coverage for affected packages. 2 sources 73

Extracted Entities

Ubuntu 18.04 Ruby Security Advisory USN-8431

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (1)