From ${URL} : Takeshi Terada (Mitsui Bussan Secure Directions, Inc.) released a whitepaper entitled "SMTP Injection via recipient email addresses" ( http://www.mbsd.jp/Whitepaper/smtpi.pdf). This whitepaper has a section discussing how one such vulnerability affected the 'mail' ruby gem (see section 3.1). Whitepaper has all the specific details, but basically the 'mail' ruby gem module is prone to the recipient attack as it does not validate nor sanitize given recipient addresses. Thus, the attacks described in chapter 2 of the whitepaper can be applied to the gem without any modification. The 'mail' ruby gem itself does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. This vulnerability affects only the applications that lack input validation. 'mail' is a "A Really Ruby Mail Library" for Ruby. Ruby gem: mail (https://rubygems.org/gems/mail) Affects: 2.5.4 and earlier Fixed in: 2.6.0 Fixed by https://github.com/mikel/mail/commit/72befdc4dab3e6e288ce226a7da2aa474cf5be83 Can a CVE be assigned? Since the issue was fixed in 2013, not sure if that means it needs a 2013 era CVE or if a 2015 one will work since it wasn't found to be a vulnerability until this year. Note, the paper author has informed me "BTW, while investigating the source code of Mail, I came to think the fault might be more on Net::SMTP's side. It is difficult to say who is responsible for it, Net::SMTP, Mail or application developers (library users) though." Either way, vuln needs to be tracked, and a change in 'mail' did mitigate it for now (and affects all their delivery methods, not just 'smtp'). @maintainer(s): since the fixed version is already in the tree, please remove the affected versions.
rails:3.2 still depends on this. Upstream support for that slot should stop once rails:5.0 is released, which should be soonish (first beta has been released). I'd rather wait until then to remove both rails:3.2 and mail:2.5, given how long this bug has already been around and known about. If the security team has a different view please let me know.
(In reply to Hans de Graaff from comment #1) > rails:3.2 still depends on this. Upstream support for that slot should stop > once rails:5.0 is released, which should be soonish (first beta has been > released). I'd rather wait until then to remove both rails:3.2 and mail:2.5, > given how long this bug has already been around and known about. > > If the security team has a different view please let me know. No that is fine, it is not a serious vulnerability. So leaving it in cleanup status.
Follow up on cleanup?
(In reply to Yury German from comment #3) > Follow up on cleanup? Rails 5 development got delayed but is now back on track. I've created a bug for rails:3.2 removal.
dev-ruby/mail:2.5 is now masked for removal.
commit fc365b6e90e6cba912827927d19ae3e513f7d529 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: Sun Aug 7 20:33:29 2016 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: Sun Aug 7 20:34:05 2016 dev-ruby/mail: Prune slot 3.2, #568978
