LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28247: The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/s...

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-28247 affects the Rust lettre email library through 0.10.0-alpha. Applications using its sendmail transport may allow untrusted input to alter sendmail options. Business urgency depends on whether the application uses lettre, uses sendmail transport, and accepts user-controlled email fields.

Executive priority

Treat as a targeted dependency review rather than a broad emergency. Prioritize systems where customer-facing forms or account workflows send mail using Rust lettre sendmail transport.

Technical view

The reported issue is arbitrary sendmail option injection in lettre's transport/sendmail/mod.rs through 0.10.0-alpha. The source bundle provides no CVSS score, CWE, affected CPEs, confirmed exploit activity, or named patched version. Exposure analysis should focus on Rust dependency versions and actual SendmailTransport usage.

Likely exposure

Likely limited to Rust applications that depend on lettre through 0.10.0-alpha and use the sendmail transport. Applications using other mail libraries or not invoking lettre sendmail behavior are not evidenced as affected by the provided sources.

Exploitation context

The bundle does not cite active exploitation, public exploit use, or CISA KEV listing. The practical risk is context-dependent: attacker influence over email-related values would matter, but the sources do not define a complete exploit path.

Researcher notes

Evidence is sparse. The CVE description identifies option injection in a specific lettre module, but the bundle lacks scoring, CWE classification, exploit confirmation, and explicit remediation details. Avoid broad claims beyond lettre through 0.10.0-alpha and sendmail transport.

Mitigation direction

  • Inventory Rust projects for lettre dependency versions through 0.10.0-alpha.
  • Check vendor and RustSec guidance before selecting an upgrade or workaround.
  • Review whether applications use lettre sendmail transport specifically.
  • Reduce untrusted control over email envelope and sendmail-related inputs.
  • Prioritize remediation where internet-facing workflows trigger email sending.

Validation and detection

  • Inspect Cargo.lock and dependency manifests for lettre versions.
  • Search code for lettre sendmail transport usage.
  • Trace user-controlled email fields into mail-sending code paths.
  • Confirm whether affected services run local sendmail-compatible binaries.
  • Record findings for services with no lettre or no sendmail transport usage.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-28247 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.