Improper Validation of Syntactic Correctness of Input Affecting mail package, versions <2.9.1

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through q_value_decode and b_value_decode in lib/mail/utilities.rb. An attacker can make a display name or local part decode to a different address than intended by supplying a malformed RFC 2047 encoded-word, including one that embeds extra encoded-word markers or additional text. The decoders only matched the first encoded-word and used a greedy charset capture, so a crafted header could cause the parsed From, To, or Reply-To value to omit or reshuffle literal text. Applications that display, compare, or authorize based on the decoded address can then present or act on a spoofed sender or recipient address.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory