https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 02:20:40 +0000 https://vulnerability.circl.lu/vuln/cve-2021-38189 <p>An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two &lt;CR&gt;&lt;LF&gt; sequences and then inject arbitrary SMTP commands.</p> <p>An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two &lt;CR&gt;&lt;LF&gt; sequences and then inject arbitrary SMTP commands.</p> https://vulnerability.circl.lu/vuln/cve-2021-38189 https://vulnerability.circl.lu/vuln/rustsec-2021-0069 <p><strong>Affected:</strong> crates.io: lettre</p> <p>Affected versions of lettre allowed SMTP command injection through an attacker&#39;s controlled message body. The module for escaping lines starting with a period wouldn&#39;t catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.</p> <p>The flaw is fixed by correctly handling consecutive CRLF sequences.</p> <p><strong>Affected:</strong> crates.io: lettre</p> <p>Affected versions of lettre allowed SMTP command injection through an attacker&#39;s controlled message body. The module for escaping lines starting with a period wouldn&#39;t catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.</p> <p>The flaw is fixed by correctly handling consecutive CRLF sequences.</p> https://vulnerability.circl.lu/vuln/rustsec-2021-0069