Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mikel/mail

              master @ f98fb65
            

Fixes

CVEs

HIGH

Peak severity

80.0%

Coverage

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

lib/mail/field_list.rb: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The library dynamically instantiated classes using header names parsed directly from incoming messages. Uncontrolled constant lookup in 'Mail.const_get' allowed arbitrary constant resolution, which could be exploited for code execution. A static map of allowed header names is now enforced.

Remote Code Execution: Unsafe YAML deserialization using 'YAML.load' allowed untrusted payloads to execute arbitrary code during message processing. This has been resolved by transitioning to 'YAML.safe_load' with an explicit list of permitted classes.

Denial of Service: Incoming emails containing multiple instances of singular-type header fields, or malformed fields, triggered unhandled NoMethodError exceptions inside helper methods like 'select_fields' and 'get_field', resulting in process crashes.