[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2018-1294: Apache Commons Email vulnerability information disclosure
From:       Jochen Wiedmann <jochen.wiedmann () gmail ! com>
Date:       2018-01-26 19:05:03
Message-ID: CAF8HOZ+J3NkaywfbHuQpHxK9ZXeT4=4Vs9rOwCDiUdnt1QA1Yw () mail ! gmail ! com
[Download RAW message or body]

CVE-2018-1294: Apache Commons Email vulnerability information
disclosure

Severity: Moderate

Vendor:
The Apache Software Foundation

Versions Affected:
All Versions of Commons-Email, from 1.0, to 1.4, inclusive. The
current version 1.5 is not affected.

Description: If a user of Commons-Email (typically an application
programmer) passes unvalidated input as the so-called "Bounce
Address", and that input contains line-breaks, then the email details
(recipients, contents, etc.) might be manipulated.

Mitigation: Users should upgrade to Commons-Email 1.5.
You can mitigate this vulnerability for older versions of Commons
Email by stripping line-breaks from data, that will be passed to
Email.setBounceAddress(String).

Credit: Alexander Lehmann

References:
http://commons.apache.org/proper/commons-email/security-reports.html
[prev in list] [next in list] [prev in thread] [next in thread]