If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the
    so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients,
    contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can
    mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that
    will be passed to Email.setBounceAddress(String). (CVE-2018-1294)

Security fix for CVE-2018-1294 (updated to 1.5)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for apache-commons-email fixes one issues.

This security issue was fixed :

  - CVE-2018-1294: Added validation to prevent information     disclosure via unchecked bounce addresses (boo#1077893).

ID	Name	Product	Family	Type	Severity
419155	SCA: security update for org.apache.commons:commons-email (GHSA-v7cm-w955-pj6g)	Tenable Cloud Security	SCA Checks	Local	high
419155	SCA: security update for org.apache.commons:commons-email (GHSA-v7cm-w955-pj6g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
106824	Fedora 26 : apache-commons-email (2018-48d385a6fd)	Nessus	Fedora Local Security Checks	Local	high
106614	openSUSE Security Update : apache-commons-email (openSUSE-2018-134)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2018-1294

high

Tenable Plugins

high

high

high

high