CVE-2015-9096

Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
CRLF Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 88%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
𝑥
≤ 2.4.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.9.1
trusty
Fixed 1.9.3.484-2ubuntu1.3
released
xenial
dne
yakkety
dne
zesty
dne
ruby2.0
trusty
Fixed 2.0.0.484-1ubuntu2.4
released
xenial
dne
yakkety
dne
zesty
dne
ruby2.3
trusty
dne
xenial
Fixed 2.3.1-2~16.04.2
released
yakkety
ignored
zesty
Fixed 2.3.3-1ubuntu0.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby2_1-2_1
suse enterprise sap 12 SP4
2.1.9-19.3.2
fixed
suse enterprise sap 12 SP5
2.1.9-19.3.2
fixed
suse enterprise server 12 SP2
2.1.9-19.3.2
fixed
suse enterprise server 12 SP3
2.1.9-19.3.2
fixed
suse enterprise server 12 SP4
2.1.9-19.3.2
fixed
suse enterprise server 12 SP5
2.1.9-19.3.2
fixed
yast2-ruby-bindings
suse enterprise server 12 SP2
3.1.53-9.8.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ruby22
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-debuginfo
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-devel
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-doc
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-irb
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-libs
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby23
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-debuginfo
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-devel
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-doc
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-irb
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-libs
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
rubygem22-bigdecimal
Amazon Linux 1
0:1.2.6-1.9.amzn1
fixed
rubygem22-io-console
Amazon Linux 1
0:0.4.3-1.9.amzn1
fixed
rubygem22-psych
Amazon Linux 1
0:2.0.8.1-1.9.amzn1
fixed
rubygem23-bigdecimal
Amazon Linux 1
0:1.2.8-1.17.amzn1
fixed
rubygem23-did_you_mean
Amazon Linux 1
0:1.0.0-1.17.amzn1
fixed
rubygem23-io-console
Amazon Linux 1
0:0.4.5-1.17.amzn1
fixed
rubygem23-json
Amazon Linux 1
0:1.8.3.1-1.17.amzn1
fixed
rubygem23-psych
Amazon Linux 1
0:2.1.0.1-1.17.amzn1
fixed
rubygems22
Amazon Linux 1
0:2.4.5.2-1.9.amzn1
fixed
rubygems22-devel
Amazon Linux 1
0:2.4.5.2-1.9.amzn1
fixed
rubygems23
Amazon Linux 1
0:2.5.2.1-1.17.amzn1
fixed
rubygems23-devel
Amazon Linux 1
0:2.5.2.1-1.17.amzn1
fixed
Common Weakness Enumeration
References
http://www.mbsd.jp/Whitepaper/smtpi.pdf
https://github.com/ruby/ruby/commit/0827a7e52ba3d957a634b063bf5a391239b9ffee
https://github.com/rubysec/ruby-advisory-db/issues/215
https://hackerone.com/reports/137631
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://www.debian.org/security/2017/dsa-3966
http://www.mbsd.jp/Whitepaper/smtpi.pdf
https://github.com/ruby/ruby/commit/0827a7e52ba3d957a634b063bf5a391239b9ffee
https://github.com/rubysec/ruby-advisory-db/issues/215
https://hackerone.com/reports/137631
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://www.debian.org/security/2017/dsa-3966