Vulnerability RUSTSEC-2021-0069
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 years ago
May 22, 2021 at 12:00 PM UTC
SMTP command injection in body
0.7.0 - 0.9.5
0.7.0 - 0.9.5
Summary
SMTP command injection in body
Details
Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.
The flaw is fixed by correctly handling consecutive CRLF sequences.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
lettre has TLS hostname verification disabled when using Boring TLS backend
0.10.1 - 0.11.21 GHSA-4pj9-g833-qx53
0.10.1 - 0.11.21 GHSA-4pj9-g833-qx53
Unknown
5 months ago
TLS hostname verification disabled when using Boring TLS backend
0.10.1 - 0.11.21 RUSTSEC-2026-0141
0.10.1 - 0.11.21 RUSTSEC-2026-0141
Medium Risk
5 years ago
Argument injection in lettre
0.7.0 and 0.8.0 - 0.8.3 and 0.9.0 - 0.9.3 GHSA-vc2p-r46x-m3vx
0.7.0 and 0.8.0 - 0.8.3 and 0.9.0 - 0.9.3 GHSA-vc2p-r46x-m3vx
Critical
5 years ago
SMTP command injection in lettre
0.7.0 - 0.9.5 GHSA-qc36-q22q-cjw3
0.7.0 - 0.9.5 GHSA-qc36-q22q-cjw3
Medium Risk
5 years ago
Argument injection in sendmail transport
0.7.0 RUSTSEC-2020-0069
0.7.0 RUSTSEC-2020-0069
Impacted packages
Timeline
Published
5 years ago
May 22, 2021 at 12:00 PM UTC
Fixed (0.9.6)
5 years ago
May 22, 2021 at 06:04 PM UTC
Fixed (0.10.0-rc.3)
5 years ago
May 22, 2021 at 06:05 PM UTC
Last Modified
2 years ago
November 08, 2023 at 04:06 AM UTC