CVE-2021-38189

CRITICAL9.8EPSS 0.48%

SMTP command injection in body

發布日:2021/7/12修改日:2023/11/8

也稱為:GHSA-qc36-q22q-cjw3RUSTSEC-2021-0069

描述

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it. The flaw is fixed by correctly handling consecutive CRLF sequences.

受影響套件(2)

crates.io/lettre>= 0.7.0, < 0.9.6
crates.io/lettre>= 0.7.0, < 0.9.6, >= 0.10.0-alpha.1, < 0.10.0-rc.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

PATCHhttps://crates.io/crates/lettre
PATCHhttps://github.com/lettre/lettre
WEBhttps://github.com/lettre/lettre/commit/8bfc20506cc5e098fe6eb3d1cafe3bea791215ce
WEBhttps://github.com/lettre/lettre/pull/627/commits/93458d01fed0ec81c0e7b4e98e6f35961356fae2
WEBhttps://github.com/lettre/lettre/security/advisories/GHSA-qc36-q22q-cjw3
WEBhttps://rustsec.org/advisories/RUSTSEC-2021-0069.html