NVD Vulnerability Detail

CVE-2015-9097

Summary	The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Publication Date	June 13, 2017, 5:29 a.m.
Registration Date	Jan. 26, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 11:39 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:mail_project:mail::::::ruby::*			2.5.4

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2015/12/11/3	Mailing List Third Party Advisory
2	http://openwall.com/lists/oss-security/2015/12/11/3	Mailing List Third Party Advisory
3	http://www.mbsd.jp/Whitepaper/smtpi.pdf	Third Party Advisory
4	http://www.mbsd.jp/Whitepaper/smtpi.pdf	Third Party Advisory
5	https://github.com/mikel/mail/commit/72befdc4dab3e6e288ce226a7da2aa474cf5be83	Exploit Third Party Advisory
6	https://github.com/mikel/mail/commit/72befdc4dab3e6e288ce226a7da2aa474cf5be83	Exploit Third Party Advisory
7	https://github.com/mikel/mail/pull/1097	Issue Tracking Third Party Advisory
8	https://github.com/mikel/mail/pull/1097	Issue Tracking Third Party Advisory
9	https://github.com/rubysec/ruby-advisory-db/issues/215	Issue Tracking Third Party Advisory
10	https://github.com/rubysec/ruby-advisory-db/issues/215	Issue Tracking Third Party Advisory
11	https://hackerone.com/reports/137631	Issue Tracking Third Party Advisory
12	https://hackerone.com/reports/137631	Issue Tracking Third Party Advisory
13	https://rubysec.com/advisories/mail-OSVDB-131677	Issue Tracking Vendor Advisory
14	https://rubysec.com/advisories/mail-OSVDB-131677	Issue Tracking Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-93	CRLF インジェクション	https://cwe.mitre.org/data/definitions/93.html

JVN Vulnerability Information

Ruby 用 mail gem における SMTP コマンドインジェクションの脆弱性

Title	Ruby 用 mail gem における SMTP コマンドインジェクションの脆弱性
Summary	Ruby 用 mail gem (別名 Really Ruby Mail Library) には、SMTP コマンドインジェクションの脆弱性が存在します。
Possible impacts	RCPT TO または MAIL FROM コマンドの CRLF シーケンスを介して、SMTP コマンドインジェクション攻撃を実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 17, 2015, midnight
Registration Date	July 21, 2017, 6 p.m.
Last Update	July 21, 2017, 6 p.m.

Affected System

Mikel Lindsaar

mail 2.5.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-9097	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9097
GitHub
2	CVE-2015-9097: prevent SMTP command injection via To/From addresses #1097	https://github.com/mikel/mail/pull/1097
National Vulnerability Database (NVD)
3	CVE-2015-9097	https://nvd.nist.gov/vuln/detail/CVE-2015-9097

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-93	https://cwe.mitre.org/data/definitions/93.html

ベンダー情報

No	Name	URL
GitHub
1	Add advisory for SMTP injection vulnerability in mail <2.6.0 #215	https://github.com/rubysec/ruby-advisory-db/issues/215
2	Also unfold and split lazily	https://github.com/mikel/mail/commit/72befdc4dab3e6e288ce226a7da2aa474cf5be83

Change Log

No	Changed Details	Date of change
0	[2017年07月21日] 掲載	Feb. 17, 2018, 10:37 a.m.