high7.5
CVE-2017-9801
Improper Input Validation in Apache Commons Email
Impact
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.commons:commons-email | >= 1.0, <= 1.4 | 1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Commons Email | Versions 1.0, 1.1, 1.2, 1.3, 1.3.1, 1.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/100082
- http://www.securitytracker.com/id/1039043
- https://lists.apache.org/thread.html/7ef903a772a2ff08605df1be819044fb15df2815eb3d63878b3fbbb5%40%3Cannounce.apache.org%3E
- https://github.com/advisories/GHSA-p7vm-phxx-g722
- https://nvd.nist.gov/vuln/detail/CVE-2017-9801
- https://lists.apache.org/thread.html/7ef903a772a2ff08605df1be819044fb15df2815eb3d63878b3fbbb5@%3Cannounce.apache.org%3E