Skip to content

2.0.7

Choose a tag to compare

View all tags
@msimerson msimerson released this 03 Sep 22:58
· 2 commits to master since this release
v2.0.7
17fb22c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • fix(security): re-stuff constructor headers to prevent SMTP smuggling
  • packaging / meta updates (#26)

header_list holds dot-unstuffed logical values; when serialising them to an SMTP DATA sink they must be re-dot-stuffed, or a header line reading as "." lands as a bare end-of-DATA terminator on the backend (transaction injection). ending_dot now forces wire stuffing to be preserved.

Ref: GHSA-rp4q-8m6x-c43c

Assets 2
Loading