Arbitrary Sendmail Option Injection in Lettre Library for Rust

CVE-2020-28247

What is CVE-2020-28247?

The Lettre library for Rust, up to version 0.10.0-alpha, suffers from a vulnerability that enables an attacker to inject arbitrary sendmail options. This flaw can allow malicious actors to manipulate sendmail behavior by exploiting the transport/sendmail/mod.rs component, potentially leading to unauthorized actions or leaks of sensitive information. Users of the affected library are urged to upgrade to newer versions to mitigate this risk. For further details, refer to the security advisories published on GitHub and RustSec.

References