Date: Fri, 4 Dec 2015 20:04:30 +0100 From: Gsunde Orangen <gsunde.orangen@...il.com> To: oss-security@...ts.openwall.com Subject: CVE Request: PHPMailer Message Injection Vulnerability Given the widespread use of PHPMailer I believe this merits a CVE ID: >From https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14: "Takeshi Terada discovered that PHPMailer accepted addresses containing line breaks. This is valid in RFC5322, but allowing such addresses resulted in invalid RFC5321 SMTP commands, permitting a kind of message injection attack. These addresses were allowed by the pcre8 validator pattern (the default in recent PHP versions). This has been mitigated by rejecting line breaks during address validation, and also by rejecting line breaks in SMTP commands, which addresses the problem for applications using the SMTP class directly." Fixed in PHPMailer 5.2.14 My (non-authoritative) guess for a CVSSv3 score: Base Score: 3.7 (Low) Temporal Score: 3.2 (Low) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C Thanks, Gsunde
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ