CVE-2020-28247 Argument injection in lettre
Attackers can inject arbitrary sendmail options in the lettre Rust library, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28247?
CVE-2020-28247 is a medium-severity command injection vulnerability in n/a, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
Which versions are affected by CVE-2020-28247?
7 open source packages ship an affected version, including lettre. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lettre crates.io | From 0.7.0 | 0.7.1, 0.8.4, 0.9.5, 0.10.0-alpha.4 |
lettre crates.io | From 0.7.0 | 0.7.1 |
lettre crates.io | From 0.7.0 | 0.7.1 |
lettre crates.io | From 0.8.0 | 0.8.4 |
lettre crates.io | From 0.8.0 | 0.8.4 |
lettre crates.io | From 0.9.0 | 0.9.5 |
1 more packages
lettre crates.io | From 0.9.0 | 0.9.5 |
Products include Lettre Lettre.
How do I fix CVE-2020-28247?
Upgrade lettre to a fixed version for your release line: 0.7.1, 0.8.4, 0.9.5 or 0.10.0-alpha.4.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-28247 being exploited?
There is no known exploitation of CVE-2020-28247 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vc2p-r46x-m3vx, RUSTSEC-2020-0069.