mikel/mail
GitHub
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| = 3.14.1 | — | 4.3 MEDIUM | ||
In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. | ||||
| <= 2.5.4 | — | 4.3 MEDIUM | ||
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring. | ||||
| — | — | 5 MEDIUM | ||
Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter. | ||||
| — | — | 7.5 HIGH | ||
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. | ||||
| = 1.4.3, = 1.2.8, = 2.2.5.1, = 2.2.4, = 2.2.5, = 1.3.1, = 1.5.1, = 2.1.5.2, = 2.1.1, = 2.2.10, = 2.1.3, = 1.5.3, = 1.3.5, = 1.3.4, = 1.2.7, = 1.6.0, = 1.4.2, = 1.4.0, = 1.2.9, = 2.2.6, = 2.2.0, = 2.1.0, = 2.0.3, = 1.1.0, = 1.5.0, = 1.3.3, = 1.2.5, = 2.2.12, = 2.2.11, = 2.2.5.2, = 2.1.5.1, = 2.2.9.1, = 2.2.3, = 2.1.5, = 1.5.2, = 1.2.6, = 1.5.4, = 1.4.1, <= 2.2.14, = 2.2.13, = 2.2.6.1, = 2.1.5.3, = 2.0.5, = 1.3.0, = 1.0.0, = 2.2.9, = 2.2.7, = 2.2.2, = 2.2.1, = 2.1.2, = 1.3.2, = 1.2.1 | — | 6.8 MEDIUM | ||
The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address. | ||||