Lettre Mailer Library Boring TLS Integration Inverted Boolean Vulnerability Disables Hostname Verification

A vulnerability exists in the lettre mailer library for Rust, specifically in versions 0.10.1 prior to 0.11.22, when the 'boring-tls' feature is enabled. An inverted-boolean bug in the TLS integration disables hostname verification for users relying on the default strict configuration. This flaw allows an on-path attacker to intercept SMTP submissions, including PLAIN/LOGIN credentials and message contents, by presenting any chain-valid certificate for any domain. Other TLS backends, such as 'native-tls' and 'rustls', are not affected.

Impact

Exploitation of this vulnerability allows interception of SMTP traffic, including authentication credentials and message content, creating a significant man-in-the-middle vulnerability.

Reproduction

To reproduce this vulnerability, use a version of the lettre library that is 0.10.1 or later, built with the 'boring-tls' feature, and the default strict configuration. An attacker can generate a TLS certificate for a controlled hostname, signed by a trusted CA, and present it during an SMTP transaction. The absence of proper hostname verification will allow the interception of the SMTP envelope, message bodies, and any SMTP authentication credentials.

Remediation

Users can update to lettre version 0.11.22 or later, where this vulnerability has been patched.