PT-2021-21996 · Lettre · Lettre

Published 2021-05-22 · Updated 2021-08-16 · CVE-2021-38189

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: lettre versions prior to 0.9.6

Description: An issue in the lettre crate for Rust allows an attacker to inject arbitrary SMTP commands through a controlled message body by placing a . character after two sequences. The module for escaping lines starting with a period does not catch a period placed after a double CRLF sequence, enabling the attacker to end the current message and write arbitrary SMTP commands after it.

Recommendations: For versions prior to 0.9.6, update to version 0.9.6 or later to fix the issue by correctly handling consecutive CRLF sequences. As a temporary workaround, consider restricting the use of the lettre crate until a patch is applied.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

CWE-147

Related Identifiers

CVE-2021-38189

GHSA-QC36-Q22Q-CJW3

RUSTSEC-2021-0069

Affected Products

Lettre

References · 11

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0069.html · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2021-0069 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qc36-q22q-cjw3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38189 · Security Note
• https://github.com/lettre/lettre · Note
• https://github.com/lettre/lettre/security/advisories/GHSA-qc36-q22q-cjw3 · Note
• https://github.com/lettre/lettre/commit/8bfc20506cc5e098fe6eb3d1cafe3bea791215ce · Note
• https://github.com/lettre/lettre/pull/627/commits/93458d01fed0ec81c0e7b4e98e6f35961356fae2 · Note
• https://crates.io/crates/lettre · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md · Note