{"id":"CVE-2021-38189","details":"An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two \u003cCR\u003e\u003cLF\u003e sequences and then inject arbitrary SMTP commands.","aliases":["GHSA-qc36-q22q-cjw3","RUSTSEC-2021-0069"],"modified":"2026-08-07T11:31:16.058361116Z","published":"2021-08-08T06:15:08.893Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:lettre:lettre:0.10.0:alpha1:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:alpha2:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:alpha3:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:alpha4:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:alpha5:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:beta1:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:beta2:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:beta3:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:beta4:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:rc1:*:*:*:rust:*:*","cpe:2.3:a:lettre:lettre:0.10.0:rc2:*:*:*:rust:*:*"],"extracted_events":[{"introduced":"0.10.0-alpha1"},{"last_affected":"0.10.0-alpha1"},{"introduced":"0.10.0-alpha2"},{"last_affected":"0.10.0-alpha2"},{"introduced":"0.10.0-alpha3"},{"last_affected":"0.10.0-alpha3"},{"introduced":"0.10.0-alpha4"},{"last_affected":"0.10.0-alpha4"},{"introduced":"0.10.0-alpha5"},{"last_affected":"0.10.0-alpha5"},{"introduced":"0.10.0-beta1"},{"last_affected":"0.10.0-beta1"},{"introduced":"0.10.0-beta2"},{"last_affected":"0.10.0-beta2"},{"introduced":"0.10.0-beta3"},{"last_affected":"0.10.0-beta3"},{"introduced":"0.10.0-beta4"},{"last_affected":"0.10.0-beta4"},{"introduced":"0.10.0-rc1"},{"last_affected":"0.10.0-rc1"},{"introduced":"0.10.0-rc2"},{"last_affected":"0.10.0-rc2"}],"source":"CPE_STRING","vendor_product":"lettre:lettre"}]},"references":[{"type":"ADVISORY","url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lettre/RUSTSEC-2021-0069.md"},{"type":"FIX","url":"https://rustsec.org/advisories/RUSTSEC-2021-0069.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lettre/lettre","events":[{"introduced":"0"},{"fixed":"5e474677f9b9a7c68066fc5c9f6b6ec36f52c391"}],"database_specific":{"cpe":"cpe:2.3:a:lettre:lettre:*:*:*:*:*:rust:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.9.6"}],"source":"CPE_RANGE"}}],"versions":["v0.9.5","v0.7.0","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.0","v0.6.0","v0.5.1","v0.5.0","v0.4.0","v0.3.0","v0.2.0","v0.1.2","v0.1.1","v0.1.0","v0.0.13","v0.0.11","v0.0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38189.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}