Alerts This Week
Warning Icon 1 1,529
Alerts This Week
Warning Icon 1 1,529

Debian 10 DLA-3725-1 Moderate: Postfix SMTP Smuggling Issue

debian lts
Calendar Grey January 30, 2024
Dist Debian Esm H88
Ubuntu Security Notice USN-5034-1 informs about a sendmail upgrade aimed at addressing email delivery vulnerabilities and improving messaging integrity.
Postfix, a popular mail server, allowed SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking
Topics%20covered

Topics Covered

security advisory debian moderate severity configuration issue postfix email exploit smtp

Summary

Remote attackers can use a published exploitation technique to
inject e-mail messages with a spoofed MAIL FROM address,
allowing bypass of an SPF protection mechanism.

This occurs because Postfix supported . but
some other popular e-mail servers do not.

To prevent attack variants (by always disallowing without ),
a different solution is required, such as setting the backported
configuration option smtpd_forbid_bare_newline=yes

For Debian 10 buster, this problem has been fixed in version
3.4.23-0+deb10u2.

We recommend that you upgrade your postfix packages.

For the detailed security status of postfix please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/postfix

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Package: postfix
Version: 3.4.23-0+deb10u2
CVE ID: CVE-2023-51764
Debian Bug: 1059230

Topics%20covered

Topics Covered

security advisory debian moderate severity configuration issue postfix email exploit smtp

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here