CVE-2021-38189 SMTP command injection in lettre
Attackers can inject arbitrary SMTP commands via crafted email bodies in the lettre crate, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38189?
CVE-2021-38189 is a critical command injection vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.
Weakness: CWE-77
Which versions are affected by CVE-2021-38189?
3 open source packages ship an affected version, including lettre. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lettre crates.io | From 0.7.0 | 0.9.6, 0.10.0-rc.3 |
lettre crates.io | From 0.7.0 | 0.9.6 |
lettre crates.io | From 0.7.0 | 0.9.6 |
Products include Lettre Lettre.
How do I fix CVE-2021-38189?
Upgrade lettre to a fixed version for your release line: 0.9.6 or 0.10.0-rc.3.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-38189 being exploited?
There is no known exploitation of CVE-2021-38189 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qc36-q22q-cjw3, RUSTSEC-2021-0069.