CVE-2021-38189 - Vulnerability Details

Vendors	Products
Lettre	Lettre

Link	Providers
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md
https://rustsec.org/advisories/RUSTSEC-2021-0069.html

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-08-08T05:10:12", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://rustsec.org/advisories/RUSTSEC-2021-0069.html"}, {"tags": ["x_refsource_MISC"], "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-38189", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://rustsec.org/advisories/RUSTSEC-2021-0069.html", "refsource": "MISC", "url": "https://rustsec.org/advisories/RUSTSEC-2021-0069.html"}, {"name": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md", "refsource": "MISC", "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:37:15.947Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://rustsec.org/advisories/RUSTSEC-2021-0069.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-38189", "datePublished": "2021-08-08T05:10:12", "dateReserved": "2021-08-08T00:00:00", "dateUpdated": "2024-08-04T01:37:15.947Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-08-08T05:10:12 (string)

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://rustsec.org/advisories/RUSTSEC-2021-0069.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve@mitre.org (string)

ID : CVE-2021-38189 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://rustsec.org/advisories/RUSTSEC-2021-0069.html (string)

refsource : MISC (string)

url : https://rustsec.org/advisories/RUSTSEC-2021-0069.html (string)

}

1 : { »

name : https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md (string)

refsource : MISC (string)

url : https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T01:37:15.947Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://rustsec.org/advisories/RUSTSEC-2021-0069.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

cveId : CVE-2021-38189 (string)

datePublished : 2021-08-08T05:10:12 (string)

dateReserved : 2021-08-08T00:00:00 (string)

dateUpdated : 2024-08-04T01:37:15.947Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lettre:lettre:*:*:*:*:*:rust:*:*", "matchCriteriaId": "01316A21-59B8-4A08-9207-E9F4FCB804B0", "versionEndExcluding": "0.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:alpha1:*:*:*:rust:*:*", "matchCriteriaId": "8B34BD62-3AB1-40B6-AEBB-15C0CD298925", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:alpha2:*:*:*:rust:*:*", "matchCriteriaId": "6D7DFF7E-BF84-41A4-B98C-077D3131094A", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:alpha3:*:*:*:rust:*:*", "matchCriteriaId": "D5133FCD-F567-40FC-9177-AD384015E9FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:alpha4:*:*:*:rust:*:*", "matchCriteriaId": "A5E3F87C-1713-4C5D-AAFD-BC0529AE648D", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:alpha5:*:*:*:rust:*:*", "matchCriteriaId": "EEE2A4E4-D834-464F-A6A4-7E06E1C2110C", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:beta1:*:*:*:rust:*:*", "matchCriteriaId": "7A6A221B-FE4C-4CCB-83D3-B835664499EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:beta2:*:*:*:rust:*:*", "matchCriteriaId": "DBED2BD1-4497-4E8F-9CDE-600E29CE0F20", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:beta3:*:*:*:rust:*:*", "matchCriteriaId": "CC28A0F2-0E4C-4F86-AEF9-AD619F41CE56", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:beta4:*:*:*:rust:*:*", "matchCriteriaId": "EDF7A66C-2831-4A02-921B-B528C46F6D29", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:rc1:*:*:*:rust:*:*", "matchCriteriaId": "744FE0A6-42D8-4FBB-B673-B7AE4BC33D3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:lettre:lettre:0.10.0:rc2:*:*:*:rust:*:*", "matchCriteriaId": "D2573F65-FA57-4B01-B65D-4CF57AEFEBEE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands."}, {"lang": "es", "value": "Se ha detectado un problema en la crate lettre versiones anteriores a 0.9.6 para Rust. En el cuerpo de un mensaje de correo electr\u00f3nico, un atacante puede colocar un car\u00e1cter . despu\u00e9s de dos secuencias (CR)(LF) y luego inyectar comandos SMTP arbitrario"}], "id": "CVE-2021-38189", "lastModified": "2024-11-21T06:16:36.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-08T06:15:08.893", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://rustsec.org/advisories/RUSTSEC-2021-0069.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://rustsec.org/advisories/RUSTSEC-2021-0069.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:lettre:lettre:*:*:*:*:*:rust:*:* (string)

matchCriteriaId : 01316A21-59B8-4A08-9207-E9F4FCB804B0 (string)

versionEndExcluding : 0.9.6 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:alpha1:*:*:*:rust:*:* (string)

matchCriteriaId : 8B34BD62-3AB1-40B6-AEBB-15C0CD298925 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:alpha2:*:*:*:rust:*:* (string)

matchCriteriaId : 6D7DFF7E-BF84-41A4-B98C-077D3131094A (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:alpha3:*:*:*:rust:*:* (string)

matchCriteriaId : D5133FCD-F567-40FC-9177-AD384015E9FD (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:alpha4:*:*:*:rust:*:* (string)

matchCriteriaId : A5E3F87C-1713-4C5D-AAFD-BC0529AE648D (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:alpha5:*:*:*:rust:*:* (string)

matchCriteriaId : EEE2A4E4-D834-464F-A6A4-7E06E1C2110C (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:beta1:*:*:*:rust:*:* (string)

matchCriteriaId : 7A6A221B-FE4C-4CCB-83D3-B835664499EC (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:beta2:*:*:*:rust:*:* (string)

matchCriteriaId : DBED2BD1-4497-4E8F-9CDE-600E29CE0F20 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:beta3:*:*:*:rust:*:* (string)

matchCriteriaId : CC28A0F2-0E4C-4F86-AEF9-AD619F41CE56 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:beta4:*:*:*:rust:*:* (string)

matchCriteriaId : EDF7A66C-2831-4A02-921B-B528C46F6D29 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:rc1:*:*:*:rust:*:* (string)

matchCriteriaId : 744FE0A6-42D8-4FBB-B673-B7AE4BC33D3C (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:lettre:lettre:0.10.0:rc2:*:*:*:rust:*:* (string)

matchCriteriaId : D2573F65-FA57-4B01-B65D-4CF57AEFEBEE (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands. (string)

}

1 : { »

lang : es (string)

value : Se ha detectado un problema en la crate lettre versiones anteriores a 0.9.6 para Rust. En el cuerpo de un mensaje de correo electrónico, un atacante puede colocar un carácter . después de dos secuencias (CR)(LF) y luego inyectar comandos SMTP arbitrario (string)

}

]

id : CVE-2021-38189 (string)

lastModified : 2024-11-21T06:16:36.260 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 7.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-08-08T06:15:08.893 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md (string)

}

1 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Third Party Advisory (string)

]

url : https://rustsec.org/advisories/RUSTSEC-2021-0069.html (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Third Party Advisory (string)

]

url : https://rustsec.org/advisories/RUSTSEC-2021-0069.html (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-77 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object