Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
CVSS Details
- CVSS 3.0 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ruby22Upgrade ruby23 | Oct 3, 2017 | Jun 12, 2017 |
| Debian | — | Upgrade ruby2.1Upgrade ruby2.3 | Dec 5, 2017 | Jun 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 16, 2021 | Jun 12, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Apr 30, 2021 | Jun 12, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Sep 24, 2019 | Jun 12, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 12, 2017 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby2.1-develUpgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade libruby2_1-2_1 | Jun 10, 2020 | Jun 12, 2017 |
| Ubuntu | — | Upgrade libruby2.0Upgrade libruby2.3Upgrade ruby2.3Upgrade ruby2.0Upgrade libruby1.9.1Upgrade ruby1.9.1 | Jul 26, 2017 | Jun 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub