Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZjMnAtcjQ2eC1tM3Z4

Argument injection in lettre

Impact

Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.

Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail's logging features).

NOTE: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.

Fix

The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.

References

• RUSTSEC-2020-0069
• CVE-2020-28247

Permalink: https://github.com/advisories/GHSA-vc2p-r46x-m3vx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZjMnAtcjQ2eC1tM3Z4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 11 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Identifiers: GHSA-vc2p-r46x-m3vx, CVE-2020-28247
References:

• https://github.com/lettre/lettre/security/advisories/GHSA-vc2p-r46x-m3vx
• https://nvd.nist.gov/vuln/detail/CVE-2020-28247
• https://github.com/RustSec/advisory-db/pull/478/files
• https://github.com/lettre/lettre/pull/508/commits/bbe7cc5381c5380b54fb8bbb4f77a3725917ff0b
• https://rustsec.org/advisories/RUSTSEC-2020-0069.html
• https://github.com/advisories/GHSA-vc2p-r46x-m3vx

Repository: https://github.com/lettre/lettre
Blast Radius: 14.6

Affected Packages