Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 466
Alerts This Week
Warning Icon 1 466

Ubuntu 23.10: USN-6591-2 Critical Postfix Email Authentication Bypass

ubuntu
Calendar Grey January 31, 2024
Dist Ubuntu Esm H88
### Vital Upgrade for Postfix to Address Email Authentication Flaw in Ubuntu. Crucial actions include
Postfix could allow bypass of email authentication if it received specially crafted network traffic.

Summary

Postfix could allow bypass of email authentication if it received

specially crafted network traffic.

Software Description:

- postfix: High-performance mail transport agent

Details:

USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of

regression has been made available since the last update. This update

updates the fix and aligns with the latest configuration guidelines

regarding this vulnerability.

We apologize for the inconvenience.

Original advisory details:

Timo Longin discovered that Postfix incorrectly handled certain email line

endings. A remote attacker could possibly use this issue to bypass an email

authentication mechanism, allowing domain spoofing and potential spamming.

Please note that certain configuration changes are required to address

this issue. They are not enabled by default for backward compatibility.

Information can be found athttps://www.postfix.org/smtp-smuggling.html.

Topics%20covered

Topics Covered

security advisory critical network traffic ubuntu postfix bypass email authentication

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   postfix                         3.8.1-2ubuntu0.2

Ubuntu 22.04 LTS:
   postfix                         3.6.4-1ubuntu1.3

Ubuntu 20.04 LTS:
   postfix                         3.4.13-0ubuntu1.4

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   postfix                         3.3.0-1ubuntu0.4+esm3

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   postfix                         3.1.0-3ubuntu0.4+esm3

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   postfix                         2.11.0-1ubuntu1.2+esm3

After a standard system update, you need to set
"smtpd_forbid_bare_newline = normalize" in your configuration and reload
it to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6591-2

https://ubuntu.com/security/notices/USN-6591-1

CVE-2023-51764,

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6591-2

Topics%20covered

Topics Covered

security advisory critical network traffic ubuntu postfix bypass email authentication

Package Information

https://launchpad.net/ubuntu/+source/postfix/3.8.1-2ubuntu0.2
https://launchpad.net/ubuntu/+source/postfix/3.6.4-1ubuntu1.3
https://launchpad.net/ubuntu/+source/postfix/3.4.13-0ubuntu1.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.