CVE-2012-2140: Improper Input Validation (CWE-20)
value: The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2012-07-18T18:55Z
Repository: https://github.com/mikel/mail
Language: Ruby
Files changed: lib/mail/network/delivery_methods/sendmail.rb, spec/mail/network/delivery_methods/sendmail_spec.rb
Commit date: 2012-03-06 19:45:23 +1100
Commit message: Making sure that destinations are also properly escaped in all version of ruby

Diff: diff --git a/lib/mail/network/delivery_methods/sendmail.rb b/lib/mail/network/delivery_methods/sendmail.rb
index d3ee970..73ef921 100644
--- a/lib/mail/network/delivery_methods/sendmail.rb
+++ b/lib/mail/network/delivery_methods/sendmail.rb
@@ -47,11 +47,11 @@ module Mail
       envelope_from = mail.return_path || mail.sender || mail.from_addrs.first
       return_path = "-f " + '"' + envelope_from.escape_for_shell + '"' if envelope_from
 
       arguments = [settings[:arguments], return_path].compact.join(" ")
 
-      self.class.call(settings[:location], arguments, mail.destinations.collect(&:shellescape).join(" "), mail)
+      self.class.call(settings[:location], arguments, mail.destinations.collect(&:escape_for_shell).join(" "), mail)
     end
 
     def self.call(path, arguments, destinations, mail)
       IO.popen("#{path} #{arguments} #{destinations}", "w+") do |io|
         io.puts mail.encoded.to_lf
diff --git a/spec/mail/network/delivery_methods/sendmail_spec.rb b/spec/mail/network/delivery_methods/sendmail_spec.rb
index 438bfe6..98c25c0 100644
--- a/spec/mail/network/delivery_methods/sendmail_spec.rb
+++ b/spec/mail/network/delivery_methods/sendmail_spec.rb
@@ -146,16 +146,16 @@ describe "sendmail delivery agent" do
       delivery_method :sendmail, :arguments => nil
     end
     
     mail = Mail.new do
       from    '"foo\";touch /tmp/PWNED;\""@blah.com'
-      to      'marcel@test.lindsaar.net'
+      to      '"foo\";touch /tmp/PWNED;\""@blah.com'
       subject 'invalid RFC2822'
     end
     
     Mail::Sendmail.should_receive(:call).with('/usr/sbin/sendmail', 
                                               "-f \"\\\"foo\\\\\\\"\\;touch /tmp/PWNED\\;\\\\\\\"\\\"@blah.com\"", 
-                                              'marcel@test.lindsaar.net', 
+                                              "\\\"foo\\\\\\\"\\;touch /tmp/PWNED\\;\\\\\\\"\\\"@blah.com", 
                                               mail)
     mail.deliver!
   end
 end

Vulnerable code:       self.class.call(settings[:location], arguments, mail.destinations.collect(&:shellescape).join(" "), mail)
      to      'marcel@test.lindsaar.net'
                                              'marcel@test.lindsaar.net', 
Fixed code:       self.class.call(settings[:location], arguments, mail.destinations.collect(&:escape_for_shell).join(" "), mail)
      to      '"foo\";touch /tmp/PWNED;\""@blah.com'
                                              "\\\"foo\\\\\\\"\\;touch /tmp/PWNED\\;\\\\\\\"\\\"@blah.com",