New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2015-9097: prevent SMTP command injection via To/From addresses #1097

Closed
wants to merge 1 commit into
base: master
from

Conversation

Projects
None yet
3 participants
@jeremy
Collaborator

jeremy commented May 9, 2017

Validate addresses passed as SMTP command arguments to prevent
injection of other SMTP commands. Disallow line breaks and very
long addresses which may cause overflows on some old SMTP servers.

Ruby 2.4 Net::SMTP already disallows addresses that contain newlines.
Enforce this validation in Mail to cover older Ruby versions and
other SMTP implementations that don't validate input.

SMTP injection whitepaper: http://www.mbsd.jp/Whitepaper/smtpi.pdf
Ruby security report: https://hackerone.com/reports/137631
OSVDB entry: https://rubysec.com/advisories/mail-OSVDB-131677

@jeremy jeremy added this to the 2.7.0 milestone May 9, 2017

SMTP security: prevent command injection via To/From addresses
Validate addresses passed as SMTP command arguments to prevent
injection of other SMTP commands. Disallow line breaks and very
long addresses which may cause overflows on some old SMTP servers.

Ruby 2.4 Net::SMTP already disallows addresses that contain newlines.
Enforce this validation in Mail to cover older Ruby versions and
other SMTP implementations that don't validate input.

SMTP injection whitepaper: http://www.mbsd.jp/Whitepaper/smtpi.pdf
Ruby security report: https://hackerone.com/reports/137631
OSVDB entry: https://rubysec.com/advisories/mail-OSVDB-131677

@jeremy jeremy closed this in cfff6c8 May 9, 2017

@jeremy jeremy deleted the jeremy:security/smtp-injection branch May 9, 2017

buren added a commit to justarrived/just_match_api that referenced this pull request May 10, 2017

@jordan-brough

This comment has been minimized.

Show comment
Hide comment
@jordan-brough

jordan-brough May 11, 2017

@jeremy when might we expect an official 2.6.6 release for this? Currently I only see a 2.6.6.rc1 on rubygems.

jordan-brough commented May 11, 2017

@jeremy when might we expect an official 2.6.6 release for this? Currently I only see a 2.6.6.rc1 on rubygems.

@jeremy

This comment has been minimized.

Show comment
Hide comment
@jeremy

jeremy May 15, 2017

Collaborator

@jordan-brough Expect an official 2.6.6 after RC1 has had a fair number of installs to shake out regressions. Note than 2.6.x is (coincidentally) not vulnerable to this issue, thanks to #505 stripping CRLF from header values.

Collaborator

jeremy commented May 15, 2017

@jordan-brough Expect an official 2.6.6 after RC1 has had a fair number of installs to shake out regressions. Note than 2.6.x is (coincidentally) not vulnerable to this issue, thanks to #505 stripping CRLF from header values.

amatriain added a commit to amatriain/feedbunch that referenced this pull request May 15, 2017

Pin mail gem to version 2.6.6.rc1
This fixes a vulnerability that allows users to send spam from any form
that allows email input (e.g. signup).

For more about the vulnerability see:

mikel/mail#1097

When implicit dependency resolution in Gemfile.lock resolves to a
released mail version that includes the fix, the explicit dependency in
Gemfile will be removed.

drewda added a commit to transitland/transitland-datastore that referenced this pull request Jun 1, 2017

eviltrout added a commit to discourse/discourse that referenced this pull request Jun 1, 2017

eviltrout added a commit to discourse/discourse that referenced this pull request Jun 1, 2017

eviltrout added a commit to discourse/discourse that referenced this pull request Jun 1, 2017

@varyonic

This comment has been minimized.

Show comment
Hide comment
@varyonic

varyonic Jun 8, 2017

One month and >10,000 downloads for 2.6.6.rc1.

varyonic commented Jun 8, 2017

One month and >10,000 downloads for 2.6.6.rc1.

@jeremy

This comment has been minimized.

Show comment
Hide comment
@jeremy

jeremy Jun 9, 2017

Collaborator

Mail 2.5.5 (tag) and 2.6.6 (tag) are released.

Collaborator

jeremy commented Jun 9, 2017

Mail 2.5.5 (tag) and 2.6.6 (tag) are released.

ylansegal added a commit to ylansegal/tokenator that referenced this pull request Jun 9, 2017

jeremyolliver added a commit to jeremyolliver/ruby-advisory-db that referenced this pull request Jun 12, 2017

Update patched versions for 2.5.X and 2.6.X+ series
As per comment mikel/mail#1097 (comment)
versions 2.5.5 and 2.6.6 include patches for this issue, 2.6.0 to 2.6.5 do not

mikel/mail 2-6-stable branch fixes in commit 37908c37dfb26ea262d0fa7916cd9bbee3750e63
mikel/mail 2-5-stable branch fixes in commit f4239e4cc03d982219a6fa58e059d8758bbd2d8f

@jeremy jeremy changed the title from SMTP security: prevent command injection via To/From addresses to CVE-2015-9097: prevent SMTP command injection via To/From addresses Jun 13, 2017

ulferts added a commit to opf/openproject that referenced this pull request Jun 13, 2017

bump mail to get rid of gemnasium security warning
OP is not affected by the vulnerability as:
* We limit the length of mail fields
* 2.6.x is not vulnerable at all (mikel/mail#1097 (comment))

But gemnasium complains and this produces a red badge which looks bad.

The rc has been around for some time now, so it should be stable enough.

I expect to bump the version once the official 2.6.6 has been released.

oliverguenther added a commit to opf/openproject that referenced this pull request Jun 14, 2017

bump mail to get rid of gemnasium security warning (#5643)
OP is not affected by the vulnerability as:
* We limit the length of mail fields
* 2.6.x is not vulnerable at all (mikel/mail#1097 (comment))

But gemnasium complains and this produces a red badge which looks bad.

The rc has been around for some time now, so it should be stable enough.

I expect to bump the version once the official 2.6.6 has been released.
[ci skip]

boltronics added a commit to sitepoint/discourse that referenced this pull request Oct 10, 2017

thegcat pushed a commit to planio-gmbh/mail that referenced this pull request Jan 26, 2018

Felix Schäfer
Merge tag '2.6.6' into 2-6-stable
Mail 2.6.6

Security:
* mikel#1097 – SMTP security: prevent command injection via To/From addresses. (jeremy)

Bugs:
* mikel#689 - Fix Exim delivery method broken by mikel#477 in 2.5.4. (jethrogb)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment