CVE-2020-28247: 
Rust vulnerability analysis and mitigation

The lettre library through 0.10.0-alpha for Rust contained a vulnerability (CVE-2020-28247) that allowed arbitrary sendmail option injection via transport/sendmail/mod.rs. The vulnerability was discovered and reported on November 11, 2020, affecting the sendmail transport functionality of the lettre library, which is a mailer library for Rust (RustSec Advisory, NVD).

The vulnerability allowed argument injection to the sendmail command through forged 'to' addresses, enabling attackers to pass arbitrary arguments to the sendmail executable. The issue was present in the sendmail transport implementation, specifically affecting functions like 'SendmailTransport::send' and 'SendmailTransport::send_raw'. The vulnerability received a CVSS v3.1 Base Score of 5.3 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

Depending on the implementation (original sendmail, postfix, exim, etc.), attackers could potentially write email data into arbitrary files using sendmail's logging features. The vulnerability only affected the 'sendmail' transport, while other transport methods like 'smtp' remained unaffected (RustSec Advisory).

The vulnerability was patched in multiple versions: >= 0.10.0-alpha.4, < 0.10.0-alpha.1 >= 0.9.5, < 0.9.0 >= 0.8.4, and < 0.8.0 >= 0.7.1. The fix involved modifying the executed command to stop parsing arguments before passing the destination addresses. Versions below 0.7.0 were unaffected by this vulnerability (RustSec Advisory).