Description
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | lettre | >= 0.9.0, < 0.9.5 | 0.9.5 | GHSA-vc2p-r46x-m3vx |
| crates.io | lettre | >= 0.8.0, < 0.8.4 | 0.8.4 | GHSA-vc2p-r46x-m3vx |
| crates.io | lettre | >= 0.7.0, < 0.7.1 | 0.7.1 | GHSA-vc2p-r46x-m3vx |
| crates.io | lettre | >= 0.7.0, < 0.7.1 · >= 0.8.0, < 0.8.4 · >= 0.9.0, < 0.9.5 · >= 0.10.0-alpha.1, < 0.10.0-alpha.4 | 0.7.1, 0.8.4, 0.9.5, 0.10.0-alpha.4 | RUSTSEC-2020-0069 |