CVE-2011-0739

CVE-2011-0739 affects the Ruby Mail gem (2.2.14 and earlier). The root cause is the deliver() path in the sendmail delivery method (lib/mail/network/delivery_methods/sendmail.rb), where shell metacharacters in an e-mail address can be injected to execute arbitrary commands. Public references conf...

Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From: Address Arbitrary Shell Command Injection

Mail Gem for Ruby contains a flaw related to the failure to properly sanitise input passed from an email from address in the 'deliver' function in 'lib/mail/network/deliverymethods/sendmail.rb' before being used as a command line argument. This may allow a remote attacker to inject arbitrary shel...