Description
Filing as an enhancement (not a bug/security report): the OpenROAD flow works fine — this is a Docker-image dependency-hygiene request. Per the project security policy, the underlying net-imap CVEs are ReDoS/DoS-class in an unused bundled gem, so they're out of scope for security@ and I'm reporting here instead.
Summary
The openroad/orfs:latest image bundles Ruby 3.0's default gem net-imap 0.1.1, which is flagged by vulnerability scanners (our institution's UT Nessus scan flagged three CVEs against it). net-imap ships as a default gem in the Ubuntu 22.04 base and is not used anywhere in the OpenROAD flow — it's purely incidental.
Note this is very likely a version-string false positive: Ubuntu commonly backports security fixes into the libruby* package without bumping the version number, so the code may already be patched even though the gemspec still reads 0.1.1. Nessus keys off that version string and flags it regardless. Either way, the stale file trips downstream scanners, so it's worth cleaning up at the image level.
Where it lives in the image
/usr/lib/ruby/gems/3.0.0/specifications/default/net-imap-0.1.1.gemspec
/usr/lib/ruby/gems/3.0.0/gems/net-imap-0.1.1
Steps to reproduce
docker pull openroad/orfs:latest
docker run --rm openroad/orfs:latest \
ls /usr/lib/ruby/gems/3.0.0/specifications/default/ | grep net-imap
# -> net-imap-0.1.1.gemspec
Impact
I think there is no functional impact on the flow as OpenROAD never calls net-imap. The problem is purely that downstream users who pull the image get flagged by CVE scanners and, in institutional environments, are required to remediate it (which currently means manually stripping the gem from the image layer). Removing it at the source would spare every downstream user that work.
Suggested Solution
Since the gem is unused, the cleanest fix is to remove the stale default-gem files at image build time:
RUN rm -rf /usr/lib/ruby/gems/3.0.0/gems/net-imap-0.1.1 \ /usr/lib/ruby/gems/3.0.0map-0.1.1.gemspec
Note that gem install net-imap -v '>= 0.5.15' is not a reliable fix here: on Ubuntu these are default gems packaged inside libruby* (outsll won't necessarily override thepackaged file the scanner sees. Removing the stale files (as above) or rebasing on a newer base image
where the packaged version is higheThis is a no-op for the flow sincenet-imap is never invoked.
Additional Context
Environment
- Image: openroad/orfs:latest (pulled ~2026-07-16)
- Ruby: 3.0.0 (Ubuntu 22.04 base default gems, packaged in libruby*)
- Affected gem: net-imap 0.1.1 → fin the 0.6.x line)
Flagged CVEs
Fixed in net-imap ≥ 0.5.15 / ≥ 0.6.4.
Description
Filing as an enhancement (not a bug/security report): the OpenROAD flow works fine — this is a Docker-image dependency-hygiene request. Per the project security policy, the underlying net-imap CVEs are ReDoS/DoS-class in an unused bundled gem, so they're out of scope for security@ and I'm reporting here instead.
Summary
The openroad/orfs:latest image bundles Ruby 3.0's default gem net-imap 0.1.1, which is flagged by vulnerability scanners (our institution's UT Nessus scan flagged three CVEs against it). net-imap ships as a default gem in the Ubuntu 22.04 base and is not used anywhere in the OpenROAD flow — it's purely incidental.
Note this is very likely a version-string false positive: Ubuntu commonly backports security fixes into the libruby* package without bumping the version number, so the code may already be patched even though the gemspec still reads 0.1.1. Nessus keys off that version string and flags it regardless. Either way, the stale file trips downstream scanners, so it's worth cleaning up at the image level.
Where it lives in the image
Steps to reproduce
Impact
I think there is no functional impact on the flow as OpenROAD never calls net-imap. The problem is purely that downstream users who pull the image get flagged by CVE scanners and, in institutional environments, are required to remediate it (which currently means manually stripping the gem from the image layer). Removing it at the source would spare every downstream user that work.
Suggested Solution
Since the gem is unused, the cleanest fix is to remove the stale default-gem files at image build time:
RUN rm -rf /usr/lib/ruby/gems/3.0.0/gems/net-imap-0.1.1 \ /usr/lib/ruby/gems/3.0.0map-0.1.1.gemspec
Note that gem install net-imap -v '>= 0.5.15' is not a reliable fix here: on Ubuntu these are default gems packaged inside libruby* (outsll won't necessarily override thepackaged file the scanner sees. Removing the stale files (as above) or rebasing on a newer base image
where the packaged version is higheThis is a no-op for the flow sincenet-imap is never invoked.
Additional Context
Environment
Flagged CVEs
Fixed in net-imap ≥ 0.5.15 / ≥ 0.6.4.