CRITICAL9.8

GHSA-w5m8-5v9m-xhx5

Critical severity vulnerability that affects Haraka

Quick fix

GHSA-w5m8-5v9m-xhx5 — Haraka: upgrade to the fixed version with the command below.

npm install Haraka@2.8.9

Details

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/Haraka

Introduced in: 0Fixed in: 2.8.9

Fixnpm install Haraka@2.8.9

References

https://nvd.nist.gov/vuln/detail/CVE-2016-1000282[ADVISORY]
https://github.com/advisories/GHSA-w5m8-5v9m-xhx5[ADVISORY]
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py[WEB]