CVE-2015-9097

The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM…

published June 12, 2017

CVSS
—
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03396 · 88.8th percentile
Published
2017-06-12T20:00Z
EPSS history
Timeline
  • 12 JUN 20:00Z
    The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM…
    cvelistv5