oss-security - CVE Request: PHPMailer Message Injection Vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5661E3BE.1050203@gmail.com>
Date: Fri, 4 Dec 2015 20:04:30 +0100
From: Gsunde Orangen <gsunde.orangen@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: PHPMailer Message Injection Vulnerability

Given the widespread use of PHPMailer I believe this merits a CVE ID:

>From https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.14:

"Takeshi Terada discovered that PHPMailer accepted addresses containing
line breaks. This is valid in RFC5322, but allowing such addresses
resulted in invalid RFC5321 SMTP commands, permitting a kind of message
injection attack. These addresses were allowed by the pcre8 validator
pattern (the default in recent PHP versions).
This has been mitigated by rejecting line breaks during address
validation, and also by rejecting line breaks in SMTP commands, which
addresses the problem for applications using the SMTP class directly."

Fixed in PHPMailer 5.2.14

My (non-authoritative) guess for a CVSSv3 score:
Base Score: 3.7 (Low)
Temporal Score: 3.2 (Low)
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

Thanks,
Gsunde

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.