COMMONS-EMAIL and CVE-2017-9801

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.3 CE GA4
• Fix Version/s: 6.2.X EE, 7.0.0 DXP FP33, 7.0.0 DXP SP7, 7.0.5 CE GA6, 7.0.X, Master
• Component/s: Core Infrastructure > Message Bus, Portal Services > Service Bus
• Labels:
  • liferay-digital-enterprise-70-sp7
  • liferay-fixpack-de-33-7010
  • liferay-fixpack-portal-168-6210
• Branch Version/s:
  7.0.x, 6.2.x
• Backported to Branch:
  Committed
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/51893
• Bug Type: Security

The source code responsible for creating emails, independently from origin, is not checking the Subject line.

Emails sent to the message bus or mail service that eventually lands here: https://github.com/liferay/liferay-portal/blob/master/portal-kernel/src/com/liferay/mail/kernel/model/MailMessage.java could benefit from multi-line check or sanitation.

https://nvd.nist.gov/vuln/detail/CVE-2017-9801

Upgrading the library would be a great plus, but it seems that a version change would affect several components and even third party software/plug-ins.