CVE-2017-9801 ( commons-email )

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9801

diff --git a/pom.xml b/pom.xml
index ec3b222af0c7ab9b802dbdd998cd22c160a3370b..ad4bb79ded17d75874e9cd8328095e038f9563c6 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -744,7 +744,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-email</artifactId>
-        <version>1.3.2</version>
+        <version>1.5</version>
       </dependency>
       <dependency>
         <groupId>commons-lang</groupId>