Vulnerability GHSA-qc36-q22q-cjw3
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
5 years ago
July 12, 2021 at 05:03 PM UTC
SMTP command injection in lettre
0.7.0 - 0.9.5
0.7.0 - 0.9.5
Summary
SMTP command injection in lettre
Details
Impact
Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.
Fix
The flaw is fixed by correctly handling consecutive CRLF sequences.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
lettre has TLS hostname verification disabled when using Boring TLS backend
0.10.1 - 0.11.21 GHSA-4pj9-g833-qx53
0.10.1 - 0.11.21 GHSA-4pj9-g833-qx53
Unknown
5 months ago
TLS hostname verification disabled when using Boring TLS backend
0.10.1 - 0.11.21 RUSTSEC-2026-0141
0.10.1 - 0.11.21 RUSTSEC-2026-0141
Medium Risk
5 years ago
Argument injection in lettre
0.7.0 and 0.8.0 - 0.8.3 and 0.9.0 - 0.9.3 GHSA-vc2p-r46x-m3vx
0.7.0 and 0.8.0 - 0.8.3 and 0.9.0 - 0.9.3 GHSA-vc2p-r46x-m3vx
Unknown
5 years ago
SMTP command injection in body
0.7.0 - 0.9.5 RUSTSEC-2021-0069
0.7.0 - 0.9.5 RUSTSEC-2021-0069
Medium Risk
5 years ago
Argument injection in sendmail transport
0.7.0 RUSTSEC-2020-0069
0.7.0 RUSTSEC-2020-0069
Impacted packages
Timeline
Published
5 years ago
July 12, 2021 at 05:03 PM UTC
Fixed (0.9.6)
5 years ago
May 22, 2021 at 06:04 PM UTC
Last Modified
2 years ago
November 08, 2023 at 04:06 AM UTC