CVE Vulnerabilities

CVE-2020-28247

Published: Nov 12, 2020 | Modified: Jan 29, 2021
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Affected Software

Name Vendor Start Version End Version
Lettre Lettre 0.8.0 (including) 0.8.3 (including)
Lettre Lettre 0.9.0 (including) 0.9.5 (including)
Lettre Lettre 0.7.0 (including) 0.7.0 (including)
Lettre Lettre 0.10.0-alpha1 (including) 0.10.0-alpha1 (including)
Lettre Lettre 0.10.0-alpha2 (including) 0.10.0-alpha2 (including)
Lettre Lettre 0.10.0-alpha3 (including) 0.10.0-alpha3 (including)

References