Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Dec 2015 20:04:30 +0100
From: Gsunde Orangen <gsunde.orangen@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: PHPMailer Message Injection Vulnerability

Given the widespread use of PHPMailer I believe this merits a CVE ID:

>From https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14:

"Takeshi Terada discovered that PHPMailer accepted addresses containing
line breaks. This is valid in RFC5322, but allowing such addresses
resulted in invalid RFC5321 SMTP commands, permitting a kind of message
injection attack. These addresses were allowed by the pcre8 validator
pattern (the default in recent PHP versions).
This has been mitigated by rejecting line breaks during address
validation, and also by rejecting line breaks in SMTP commands, which
addresses the problem for applications using the SMTP class directly."

Fixed in PHPMailer 5.2.14

My (non-authoritative) guess for a CVSSv3 score:
Base Score: 3.7 (Low)
Temporal Score: 3.2 (Low)
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

Thanks,
Gsunde

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ