CVE-2015-9096: Command Injection
Published Jun 12, 2017
·Updated
Last updated 24 July 2024
Other sources
Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Affected Software
4 affected components
debian/ruby1.8
debian/ruby1.9.1
debian/ruby2.1
ruby-lang Ruby<=2.4.0
Remediation
Event History
Jun 12, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:16 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·01:12 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-9096?
CVE-2015-9096 is considered a medium severity vulnerability due to its potential for SMTP command injection.
2
How do I fix CVE-2015-9096?
To fix CVE-2015-9096, update Ruby to version 2.4.0 or later.
3
Which versions of Ruby are affected by CVE-2015-9096?
CVE-2015-9096 affects Ruby versions prior to 2.4.0 including ruby1.8, ruby1.9.1, and ruby2.1.
4
What type of vulnerability is CVE-2015-9096?
CVE-2015-9096 is an SMTP command injection vulnerability.
5
Is there a workaround for CVE-2015-9096?
There is no known workaround for CVE-2015-9096; the recommended solution is to upgrade Ruby.