CVE-2025-59937
go-mail has insufficient address encoding when passing mail addresses to the SMTP client
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek).
Açıklama
go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | gitea, gitea-fips, sftpgo | 1.24.6-r1 ve 1 tane daha |
| go::GitHub Security Advisory Go | github.com/wneessen/go-mail | 0.7.1 |
| wolfi | gitea, sftpgo | 1.24.6-r1 ve 1 tane daha |
3 kaynaktaki 6 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | gitea | 1.24.6-r1 |
| chainguard | gitea-fips | 1.24.6-r1 |
| chainguard | sftpgo | 2.6.6-r9 |
| go::GitHub Security Advisory Go | github.com/wneessen/go-mail | 0.7.1 |
| wolfi | gitea | 1.24.6-r1 |
| wolfi | sftpgo | 2.6.6-r9 |
Referanslar
- https://github.com/wneessen/go-mail
- https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479
- https://github.com/wneessen/go-mail/issues/495
- https://github.com/wneessen/go-mail/pull/496
- https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5
- https://nvd.nist.gov/vuln/detail/CVE-2025-59937
- https://pkg.go.dev/vuln/GO-2025-3988