Potential TLS Verification Bug in Rust 'lettre' Package
An inverted-boolean bug in the Rust 'lettre' package's 'boring-tls' integration reportedly disables TLS hostname verification for callers using the default configuration. This may allow an on-path attacker to intercept SMTP submission, including PLAIN/LOGIN credentials and message contents.
What happened
An early warning has been issued regarding a potential critical vulnerability in the Rust 'lettre' package when using the 'boring-tls' backend. The issue, tracked as GHSA-4PJ9-G833-QX53, appears to be an inverted-boolean bug that silently disables TLS hostname verification for callers using the default (strict) configuration. This misconfiguration may allow an on-path attacker to intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any user built with the 'boring-tls' feature.
The vulnerability is under investigation and has not been confirmed. However, the recommended action for those using affected versions is to upgrade to a version of 'lettre' that fixes the TLS hostname verification issue or switch to a different TLS backend. Affected versions include multiple ranges introduced and fixed across different 'lettre' versions.
Professional software engineers assessing their own exposure should consult the primary sources for detailed version information and recommended actions. The primary source for this advisory is the GitHub Security Advisory GHSA-4pj9-g833-qx53.
How 0Day mitigates this
lettre is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.