GitHub Advisoryadvisory · crates.io

GHSA-qc36-q22q-cjw3 SMTP command injection in lettre

CRITICAL Published 2021-07-12 Modified 2021-08-18 Official page ↗
Aliases
CVE-2021-38189
Ecosystem
crates.io
Packages
lettre
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-147
Reviewed
2021-06-01

Affected packages

• crates.io lettre: >= 0.7.0, < 0.9.6 → fixed in 0.9.6

Description

Impact Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it. Fix The flaw is fixed by correctly handling consecutive CRLF sequences. References • RUSTSEC-2021-0069

Related

Alias · CVE (1)

  • CVE-2021-38189 An issue was discovered in the lettre crate before 0.9.6 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-147 Improper Neutralization of Input Terminators weakness

References