https://bugzilla.redhat.com/show_bug.cgi?id=1477540
Bug ID: 1477540
Summary: CVE-2017-9801 apache-commons-email: SMTP header
injection vulnerabilty
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
SpikeFedora(a)gmail.com
When a call-site passes a subject for an email that contains line-breaks, the
caller can add arbitrary SMTP headers.
This vulnerability can be mitigated for older versions of Commons Email by
stripping line-breaks from the subject before passing it to the
setSubject(String) method.
References:
http://seclists.org/oss-sec/2017/q3/231
--
You are receiving this mail because:
You are on the CC list for the bug.