Design/Logic Flaw

2020-11-1218:15:00

PRIOn knowledge base

www.prio-n.com

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.7%

JSON

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

CPENameOperatorVersion
lettreeq0.10.0 alpha1
lettreeq0.7.0
lettreeq0.10.0 alpha2
lettreeq0.10.0 alpha3
lettrege0.9.0
lettrele0.9.5
lettrege0.8.0
lettrele0.8.3

Name	Operator	Version
lettre	eq	0.10.0 alpha1
lettre	eq	0.7.0
lettre	eq	0.10.0 alpha2
lettre	eq	0.10.0 alpha3
lettre	ge	0.9.0
lettre	le	0.9.5
lettre	ge	0.8.0
lettre	le	0.8.3

References

github.com/lettre/lettre

github.com/RustSec/advisory-db/pull/478/files

rustsec.org/advisories/RUSTSEC-2020-0069.html