Approved changes feed: RSS · Atom
cpe:2.3:a:lettre:lettre:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Lettre (e68d6024-0a2c-5030-b7f5-caf2547543c0) |
|---|---|
| Product | Lettre (c1e82f9e-1a6f-5270-aba4-a11ece2d98b9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/lettre/lettre |
purl2cpe | 2026-06-01 10:17:42.969401 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46428 |
vulnerable | 2026-07-29 00:54:58.919253 |
lettre has TLS hostname verification disabled when using Boring TLS backend
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the `boring-tls` feature. Other TLS backends (`native-tls`, `rustls`) are unaffected. Version 0.11.22 patches the issue.
Published: 2026-07-20T15:37:58.396Z
Updated: 2026-07-21T15:49:36.495Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28247 |
vulnerable | 2026-06-08 05:23:53.930838 |
Details available
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
Published: 2020-11-12T18:03:45.000Z
Updated: 2024-08-04T16:33:58.761Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.