CVE-2018-1294: Apache Commons Email vulnerability information disclosure

[Jochen Wiedmann <jochen.wiedmann () gmail com>]

CVE-2018-1294: Apache Commons Email vulnerability information
disclosure

Severity: Moderate

Vendor:
The Apache Software Foundation

Versions Affected:
All Versions of Commons-Email, from 1.0, to 1.4, inclusive. The
current version 1.5 is not affected.

Description: If a user of Commons-Email (typically an application
programmer) passes unvalidated input as the so-called "Bounce
Address", and that input contains line-breaks, then the email details
(recipients, contents, etc.) might be manipulated.

Mitigation: Users should upgrade to Commons-Email 1.5.
You can mitigate this vulnerability for older versions of Commons
Email by stripping line-breaks from data, that will be passed to
Email.setBounceAddress(String).

Credit: Alexander Lehmann

References:
http://commons.apache.org/proper/commons-email/security-reports.html