CVE-2015-9097: prevent SMTP command injection via To/From addresses#1097
Closed
jeremy wants to merge 1 commit into
Closed
CVE-2015-9097: prevent SMTP command injection via To/From addresses#1097jeremy wants to merge 1 commit into
jeremy wants to merge 1 commit into
Conversation
jeremy
force-pushed
the
security/smtp-injection
branch
from
7c2bc76 to
6671495
Compare
Validate addresses passed as SMTP command arguments to prevent injection of other SMTP commands. Disallow line breaks and very long addresses which may cause overflows on some old SMTP servers. Ruby 2.4 Net::SMTP already disallows addresses that contain newlines. Enforce this validation in Mail to cover older Ruby versions and other SMTP implementations that don't validate input. SMTP injection whitepaper: http://www.mbsd.jp/Whitepaper/smtpi.pdf Ruby security report: https://hackerone.com/reports/137631 OSVDB entry: https://rubysec.com/advisories/mail-OSVDB-131677
jeremy
force-pushed
the
security/smtp-injection
branch
from
6671495 to
31c6ca4
Compare
This was referenced May 9, 2017
This was referenced May 9, 2017
buren
added a commit
to justarrived/just_match_api
that referenced
this pull request
May 10, 2017
|
@jeremy when might we expect an official 2.6.6 release for this? Currently I only see a |
Collaborator
Author
|
@jordan-brough Expect an official 2.6.6 after RC1 has had a fair number of installs to shake out regressions. Note than 2.6.x is (coincidentally) not vulnerable to this issue, thanks to #505 stripping CRLF from header values. |
amatriain
added a commit
to amatriain/feedbunch
that referenced
this pull request
May 15, 2017
This fixes a vulnerability that allows users to send spam from any form that allows email input (e.g. signup). For more about the vulnerability see: mikel/mail#1097 When implicit dependency resolution in Gemfile.lock resolves to a released mail version that includes the fix, the explicit dependency in Gemfile will be removed.
drewda
added a commit
to transitland/transitland-datastore
that referenced
this pull request
Jun 1, 2017
see mikel/mail#1097 TODO: remove once mikel/mail#1116 is addressed
eviltrout
added a commit
to discourse/discourse
that referenced
this pull request
Jun 1, 2017
eviltrout
added a commit
to discourse/discourse
that referenced
this pull request
Jun 1, 2017
eviltrout
added a commit
to discourse/discourse
that referenced
this pull request
Jun 1, 2017
|
One month and >10,000 downloads for 2.6.6.rc1. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validate addresses passed as SMTP command arguments to prevent
injection of other SMTP commands. Disallow line breaks and very
long addresses which may cause overflows on some old SMTP servers.
Ruby 2.4 Net::SMTP already disallows addresses that contain newlines.
Enforce this validation in Mail to cover older Ruby versions and
other SMTP implementations that don't validate input.
SMTP injection whitepaper: http://www.mbsd.jp/Whitepaper/smtpi.pdf
Ruby security report: https://hackerone.com/reports/137631
OSVDB entry: https://rubysec.com/advisories/mail-OSVDB-131677