MGASA-2016-0019
Updated ruby-mail packages fix security vulnerability
The Mail library does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. The attacker-injected message in the recipient address is processed by the server. This type of vulnerability can be real threats in inquiry forms, member signup forms, or any other application that delivers an email to a user-specified email address (bsc#959129)
What each source reports
OSV No score
Updated ruby-mail packages fix security vulnerability
The Mail library does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. The attacker-injected message in the recipient address is processed by the server. This type of vulnerability can be real threats in inquiry forms, member signup forms, or any other application that delivers an email to a user-specified email address (bsc#959129)
- Record
MGASA-2016-0019- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ruby-mailMageia:5 |
before 2.5.4-9.1.mga5 | 2.5.4-9.1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2016-0019 is a vulnerability with no CVSS score yet in ruby-mail, published January 15, 2016. No source lists public exploit code. Fixed in ruby-mail 2.5.4-9.1.mga5.