Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ruby/net-pop

              master @ d4e1675
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 2 prior fixes. Scrutinize any change in this area.

lib/net/pop.rb: most-fixed (4 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Improper Certificate Validation: The library failed to perform post-connection hostname verification on SSL/TLS sockets, potentially allowing MITM attacks even when certificate verification was enabled. Future network code must enforce explicit post_connection_check validations.

Command Injection: User-supplied command arguments containing CR/LF characters or raw format strings were written directly to the protocol socket, leading to command and argument injection. Strict character validation and safe formatting are required for all socket-bound parameters.

Insecure Defaults: Net::POP3 historically defaulted to VERIFY_NONE instead of VERIFY_PEER during SSL/TLS context initialization, rendering secure transport insecure by default. Default verification levels must be consistently secure across all connection paths.