libnetty-java: Netty is an asynchronous, event-driven network application framework

Netty is an asynchronous, event-driven network application framework. Inversions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Nettycontains an SMTP command injection vulnerability due to insufficient inputvalidation for Carriage Return (\r) and Line Feed (\n) characters inuser-supplied parameters. The vulnerability exists inio.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters aredirectly concatenated into the SMTP command string without sanitization.When methods such as SmtpRequests.rcpt(recipient) are called with amalicious string containing CRLF sequences, attackers can inject arbitrarySMTP commands. Because the injected commands are sent from the server'strusted IP address, resulting emails will likely pass SPF and DKIMauthentication checks, making them appear legitimate. This allows remoteattackers who can control SMTP command parameters (such as emailrecipients) to forge arbitrary emails from the trusted server, potentiallyimpersonating executives and forging high-stakes corporate communications.This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. Noknown workarounds exist.

Where it's fixed