GHSA-qc36-q22q-cjw3CriticalCVSS 9.8

SMTP command injection in lettre

Published
July 12, 2021
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-38189 →

📋 Description

Impact

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.

Fix

The flaw is fixed by correctly handling consecutive CRLF sequences.

References

🎯 Affected products1

  • rust/lettre:>= 0.7.0, < 0.9.6

🔗 References (5)