PT-2018-11495 · Apache · Apache Commons Email

Alexander Lehmann · Publicado 2018-02-24 · Atualizado 2022-05-14 · CVE-2018-1294

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Commons Email versions prior to 1.5

Description The issue allows manipulation of email details, such as recipients and contents, if unvalidated input containing line-breaks is passed as the "Bounce Address".

Recommendations For versions prior to 1.5, strip line-breaks from data passed to Email.setBounceAddress(String) as a mitigation measure. Upgrade to Commons-Email 1.5 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1294

GHSA-V7CM-W955-PJ6G

MGASA-2018-0136

Produtos afetados

Apache Commons Email

Referências · 12

• https://osv.dev/vulnerability/CVE-2018-1294 · Aviso do Fabricante
• https://marc.info/?i=CAF8HOZ+J3NkaywfbHuQpHxK9ZXeT4=[e-mail] · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1294 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1294 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=22473 · Nota
• http://seclists.org/oss-sec/2018/q1/107 · Nota
• https://osv.dev/vulnerability/GHSA-v7cm-w955-pj6g · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2018-0136 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6BK3RDWBGNZHZ6LDJ34DAWVCBE2UGUE3 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1294 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2018-0136.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-1294 · Aviso do Fabricante