GHSA-qc36-q22q-cjw3

Suggest an improvement
Source
https://github.com/advisories/GHSA-qc36-q22q-cjw3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-qc36-q22q-cjw3/GHSA-qc36-q22q-cjw3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qc36-q22q-cjw3
Aliases
Published
2021-07-12T17:03:27Z
Modified
2023-11-08T04:06:25.799670Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SMTP command injection in lettre
Details

Impact

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.

Fix

The flaw is fixed by correctly handling consecutive CRLF sequences.

References

Database specific 
{
    "nvd_published_at": "2021-08-08T06:15:00Z",
    "github_reviewed_at": "2021-06-01T20:41:39Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-147"
    ]
}
References

Affected packages

crates.io / lettre

Package

Name
lettre
View open source insights on deps.dev
Purl
pkg:cargo/lettre

Affected ranges

Type
SEMVER
Events
Introduced
0.7.0
Fixed
0.9.6

Ecosystem specific 

{
    "affected_functions": [
        "lettre::smtp::SmtpTransport::send",
        "lettre::transport::smtp::SmtpTransport::send",
        "lettre::transport::smtp::SmtpTransport::send_raw"
    ]
}