CVE-2020-28247: Argument Injection in lettre
Summary
CVE-2020-28247: Argument injection in lettre. Affects lettre across 3 version ranges.
>= 0.7.0, < 0.7.1
>= 0.8.0, < 0.8.4
>= 0.9.0, < 0.9.5
Fixed in 0.7.1, 0.8.4 or 0.9.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lettre is a crate for sending emails in Rust. It provides various transport methods, including sendmail. The affected versions of lettre allowed argument injection to the sendmail command, which could lead to arbitrary arguments being passed to the sendmail executable. This could potentially allow an attacker to write email data into arbitrary files, depending on the implementation of sendmail. It's important to note that this vulnerability only affects the sendmail transport, while other transports like smtp are not affected.
Vulnerability Detail
The argument injection vulnerability in lettre allowed attackers to forge email addresses and pass arbitrary arguments to the sendmail executable. This could potentially lead to writing email data into arbitrary files using sendmail's logging features. The impact of this vulnerability depends on the specific implementation of sendmail, postfix, exim, etc. The flaw was fixed by modifying the executed command to stop parsing arguments before passing the destination addresses.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.7.0, < 0.7.10.7.1 -
>= 0.8.0, < 0.8.40.8.4 -
>= 0.9.0, < 0.9.50.9.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The argument injection vulnerability in lettre allowed attackers to pass arbitrary arguments to the sendmail executable, potentially leading to writing email data into arbitrary files. It is recommended to update the lettre package to version 0.9.5 or higher to fix this vulnerability. Regularly checking for updates and applying them is crucial for maintaining the security of the application.
See every vulnerability recorded for lettre →
FAQ
Versions 0.7.0 to 0.7.1, 0.8.0 to 0.8.4, and 0.9.0 to 0.9.4 of lettre are affected by this vulnerability.
Yes, this vulnerability can be exploited remotely if the affected application is exposed to untrusted input.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, the CVSS score for this vulnerability is 5.3 (Medium).
You can find more information about this vulnerability in the RUSTSEC advisory RUSTSEC-2020-0069 and the CVE entry CVE-2020-28247.
References
Related vulnerabilities
Recent vulnerabilities recorded for lettre.
