Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
CVSS Details
- CVSS 3.0 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ruby23Upgrade ruby22 | Oct 3, 2017 | Jun 12, 2017 |
| Debian | — | Upgrade ruby2.3Upgrade ruby2.1 | Dec 5, 2017 | Jun 12, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 16, 2021 | Jun 12, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Apr 30, 2021 | Jun 12, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Sep 24, 2019 | Jun 12, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 12, 2017 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade ruby2.1-develUpgrade yast2-ruby-bindings | Jun 10, 2020 | Jun 12, 2017 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade ruby2.0Upgrade libruby1.9.1Upgrade libruby2.0Upgrade libruby2.3Upgrade ruby2.3 | Jul 26, 2017 | Jun 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub