CVS: cvs.openbsd.org: src
Gilles Chehade <[email protected]>
| Newsgroups | gmane.os.openbsd.cvs |
|---|---|
| Message-ID | <[email protected]> |
CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/07/12 17:24:47 Modified files: usr.sbin/smtpd : enqueue.c Log message: reject CR and LF in argv-derived fields before starting the SMTP dialogue enqueue interpolates the sender, recipients and DSN options straight into MAIL FROM / RCPT TO command lines. an embedded CR or LF split the command boundary and injected additional SMTP commands over the local session, so refuse any such field up front. from Andrew Griffiths (fixed by me), ok op@