CVE-2021-38189

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it. The flaw is fixed by correctly handling consecutive CRLF sequences.

### Impact Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it. ### Fix The flaw is fixed by correctly handling consecutive CRLF sequences. ### References * [RUSTSEC-2021-0069](https://rustsec.org/advisories/RUSTSEC-2021-0069.html)

Se ha detectado un problema en la crate lettre versiones anteriores a 0.9.6 para Rust. En el cuerpo de un mensaje de correo electrónico, un atacante puede colocar un carácter . después de dos secuencias (CR)(LF) y luego inyectar comandos SMTP arbitrario