Improper Input Validation in Apache Commons Email

2022-05-1702:15:41

Google

osv.dev

0.003 Low

EPSS

Percentile

68.4%

JSON

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.

CPENameOperatorVersion
org.apache.commons:commons-emaileq1.2
org.apache.commons:commons-emaileq1.4
org.apache.commons:commons-emaileq1.1
org.apache.commons:commons-emaileq1.3.3
org.apache.commons:commons-emaileq1.3
org.apache.commons:commons-emaileq1.3.1
org.apache.commons:commons-emaileq1.3.2

Name	Operator	Version
org.apache.commons:commons-email	eq	1.2
org.apache.commons:commons-email	eq	1.4
org.apache.commons:commons-email	eq	1.1
org.apache.commons:commons-email	eq	1.3.3
org.apache.commons:commons-email	eq	1.3
org.apache.commons:commons-email	eq	1.3.1
org.apache.commons:commons-email	eq	1.3.2