Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2015-9097: prevent SMTP command injection via To/From addresses #1097

Closed
wants to merge 1 commit into from

Conversation

@jeremy
Copy link
Collaborator

@jeremy jeremy commented May 9, 2017

Validate addresses passed as SMTP command arguments to prevent
injection of other SMTP commands. Disallow line breaks and very
long addresses which may cause overflows on some old SMTP servers.

Ruby 2.4 Net::SMTP already disallows addresses that contain newlines.
Enforce this validation in Mail to cover older Ruby versions and
other SMTP implementations that don't validate input.

SMTP injection whitepaper: http://www.mbsd.jp/Whitepaper/smtpi.pdf
Ruby security report: https://hackerone.com/reports/137631
OSVDB entry: https://rubysec.com/advisories/mail-OSVDB-131677

@jeremy jeremy added this to the 2.7.0 milestone May 9, 2017
@jeremy jeremy force-pushed the jeremy:security/smtp-injection branch from 7c2bc76 to 6671495 May 9, 2017
Validate addresses passed as SMTP command arguments to prevent
injection of other SMTP commands. Disallow line breaks and very
long addresses which may cause overflows on some old SMTP servers.

Ruby 2.4 Net::SMTP already disallows addresses that contain newlines.
Enforce this validation in Mail to cover older Ruby versions and
other SMTP implementations that don't validate input.

SMTP injection whitepaper: http://www.mbsd.jp/Whitepaper/smtpi.pdf
Ruby security report: https://hackerone.com/reports/137631
OSVDB entry: https://rubysec.com/advisories/mail-OSVDB-131677
@jeremy jeremy force-pushed the jeremy:security/smtp-injection branch from 6671495 to 31c6ca4 May 9, 2017
@jeremy jeremy closed this in cfff6c8 May 9, 2017
@jeremy jeremy deleted the jeremy:security/smtp-injection branch May 9, 2017
buren added a commit to justarrived/just_match_api that referenced this pull request May 10, 2017
@jordan-brough
Copy link

@jordan-brough jordan-brough commented May 11, 2017

@jeremy when might we expect an official 2.6.6 release for this? Currently I only see a 2.6.6.rc1 on rubygems.

@jeremy
Copy link
Collaborator Author

@jeremy jeremy commented May 15, 2017

@jordan-brough Expect an official 2.6.6 after RC1 has had a fair number of installs to shake out regressions. Note than 2.6.x is (coincidentally) not vulnerable to this issue, thanks to #505 stripping CRLF from header values.

amatriain added a commit to amatriain/feedbunch that referenced this pull request May 15, 2017
This fixes a vulnerability that allows users to send spam from any form
that allows email input (e.g. signup).

For more about the vulnerability see:

mikel/mail#1097

When implicit dependency resolution in Gemfile.lock resolves to a
released mail version that includes the fix, the explicit dependency in
Gemfile will be removed.
drewda added a commit to transitland/transitland-datastore that referenced this pull request Jun 1, 2017
eviltrout added a commit to discourse/discourse that referenced this pull request Jun 1, 2017
eviltrout added a commit to discourse/discourse that referenced this pull request Jun 1, 2017
eviltrout added a commit to discourse/discourse that referenced this pull request Jun 1, 2017
@varyonic
Copy link

@varyonic varyonic commented Jun 8, 2017

One month and >10,000 downloads for 2.6.6.rc1.

@jeremy
Copy link
Collaborator Author

@jeremy jeremy commented Jun 9, 2017

Mail 2.5.5 (tag) and 2.6.6 (tag) are released.

ylansegal added a commit to ylansegal/tokenator that referenced this pull request Jun 9, 2017
jeremyolliver added a commit to jeremyolliver/ruby-advisory-db that referenced this pull request Jun 12, 2017
As per comment mikel/mail#1097 (comment)
versions 2.5.5 and 2.6.6 include patches for this issue, 2.6.0 to 2.6.5 do not

mikel/mail 2-6-stable branch fixes in commit 37908c37dfb26ea262d0fa7916cd9bbee3750e63
mikel/mail 2-5-stable branch fixes in commit f4239e4cc03d982219a6fa58e059d8758bbd2d8f
@jeremy jeremy changed the title SMTP security: prevent command injection via To/From addresses CVE-2015-9097: prevent SMTP command injection via To/From addresses Jun 13, 2017
ulferts added a commit to opf/openproject that referenced this pull request Jun 13, 2017
OP is not affected by the vulnerability as:
* We limit the length of mail fields
* 2.6.x is not vulnerable at all (mikel/mail#1097 (comment))

But gemnasium complains and this produces a red badge which looks bad.

The rc has been around for some time now, so it should be stable enough.

I expect to bump the version once the official 2.6.6 has been released.
oliverguenther added a commit to opf/openproject that referenced this pull request Jun 14, 2017
OP is not affected by the vulnerability as:
* We limit the length of mail fields
* 2.6.x is not vulnerable at all (mikel/mail#1097 (comment))

But gemnasium complains and this produces a red badge which looks bad.

The rc has been around for some time now, so it should be stable enough.

I expect to bump the version once the official 2.6.6 has been released.
[ci skip]
boltronics added a commit to sitepoint/discourse that referenced this pull request Oct 10, 2017
thegcat pushed a commit to planio-gmbh/mail that referenced this pull request Jan 26, 2018
Mail 2.6.6

Security:
* mikel#1097 – SMTP security: prevent command injection via To/From addresses. (jeremy)

Bugs:
* mikel#689 - Fix Exim delivery method broken by mikel#477 in 2.5.4. (jethrogb)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants
You can’t perform that action at this time.