https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 01:10:15 +0000 https://cve.radiocsirt.org/vuln/cve-2020-28247 <p>The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.</p> <p>The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.</p> https://cve.radiocsirt.org/vuln/cve-2020-28247 https://cve.radiocsirt.org/vuln/ghsa-vc2p-r46x-m3vx <p><strong>Affected:</strong> crates.io: lettre</p> <p>### Impact</p> <p>Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.</p> <p>Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail&#39;s logging features).</p> <p>*NOTE*: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.</p> <p>### Fix</p> <p>The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.</p> <p>### References</p> <p>* [RUSTSEC-2020-0069](https://rustsec.org/advisories/RUSTSEC-2020-0069.html) * [CVE-2020-28247](https://nvd.nist.gov/vuln/detail/CVE-2020-28247)</p> <p><strong>Affected:</strong> crates.io: lettre</p> <p>### Impact</p> <p>Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.</p> <p>Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail&#39;s logging features).</p> <p>*NOTE*: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.</p> <p>### Fix</p> <p>The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.</p> <p>### References</p> <p>* [RUSTSEC-2020-0069](https://rustsec.org/advisories/RUSTSEC-2020-0069.html) * [CVE-2020-28247](https://nvd.nist.gov/vuln/detail/CVE-2020-28247)</p> https://cve.radiocsirt.org/vuln/ghsa-vc2p-r46x-m3vx