This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-7769 →
DEBIAN-CVE-2020-7769
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail...
Original description
The description as published by the source.
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
node-nodemailer
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.16-1"}]}]
Debian:13
node-nodemailer
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.16-1"}]}]
Debian:14
node-nodemailer
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.16-1"}]}]
References
- advisory security-tracker.debian.org