Postfix could allow bypass of email authentication if it received specially crafted network traffic.. ========================================================================== Ubuntu Security Notice USN-6591-2 January 31, 2024 postfix update ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Postfix could allow bypass of email authentication if it received specially crafted network traffic. Software Description: - postfix: High-performance mail transport agent Details: USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of regression has been made available since the last update. This update updates the fix and aligns with the latest configuration guidelines regarding this vulnerability. We apologize for the inconvenience. Original advisory details: Timo Longin discovered that Postfix incorrectly handled certain email line endings. A remote attacker could possibly use this issue to bypass an email authentication mechanism, allowing domain spoofing and potential spamming. Please note that certain configuration changes are required to address this issue. They are not enabled by default for backward compatibility. Information can be found athttps://www.postfix.org/smtp-smuggling.html. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: postfix 3.8.1-2ubuntu0.2 Ubuntu 22.04 LTS: postfix 3.6.4-1ubuntu1.3 Ubuntu 20.04 LTS: postfix 3.4.13-0ubuntu1.4 Ubuntu 18.04 LTS (Available with Ubuntu Pro): postfix 3.3.0-1ubuntu0.4+esm3 Ubuntu 16.04 LTS(Available with Ubuntu Pro): postfix 3.1.0-3ubuntu0.4+esm3 Ubuntu 14.04 LTS (Available with Ubuntu Pro): postfix 2.11.0-1ubuntu1.2+esm3 After a standard system update, you need to set "smtpd_forbid_bare_newline = normalize" in your configuration and reload it to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6591-2 https://ubuntu.com/security/notices/USN-6591-1 CVE-2023-51764, Package Information: https://launchpad.net/ubuntu/+source/postfix/3.8.1-2ubuntu0.2 https://launchpad.net/ubuntu/+source/postfix/3.6.4-1ubuntu1.3 https://launchpad.net/ubuntu/+source/postfix/3.4.13-0ubuntu1.4 . ### Vital Upgrade for Postfix to Address Email Authentication Flaw in Ubuntu. Crucial actions include. Postfix Issue, Email Bypass, Security Update, Authentication Flaw, Ubuntu Advisory. . Severity: Critical. LinuxSecurity.com Team
Postfix could allow bypass of email authentication if it received specially crafted network traffic.. ========================================================================== Ubuntu Security Notice USN-6591-1 January 22, 2024 postfix vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Postfix could allow bypass of email authentication if it received specially crafted network traffic. Software Description: - postfix: High-performance mail transport agent Details: Timo Longin discovered that Postfix incorrectly handled certain email line endings. A remote attacker could possibly use this issue to bypass an email authentication mechanism, allowing domain spoofing and potential spamming. Please note that certain configuration changes are required to address this issue. They are not enabled by default for backward compatibility. Information can be found athttps://www.postfix.org/smtp-smuggling.html. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: postfix 3.8.1-2ubuntu0.1 Ubuntu 22.04 LTS: postfix 3.6.4-1ubuntu1.2 Ubuntu 20.04 LTS: postfix 3.4.13-0ubuntu1.3 Ubuntu 18.04 LTS (Available with Ubuntu Pro): postfix 3.3.0-1ubuntu0.4+esm2 Ubuntu 16.04 LTS (Available with Ubuntu Pro): postfix 3.1.0-3ubuntu0.4+esm2 Ubuntu 14.04 LTS (Available with Ubuntu Pro): postfix 2.11.0-1ubuntu1.2+esm2 After a standard system update you need to enable smtpd_forbid_bare_newline in your configuration and reload it tomake all the necessary changes. References: https://ubuntu.com/security/notices/USN-6591-1 CVE-2023-51764,https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/2049337 Package Information: https://launchpad.net/ubuntu/+source/postfix/3.8.1-2ubuntu0.1 https://launchpad.net/ubuntu/+source/postfix/3.6.4-1ubuntu1.2 https://launchpad.net/ubuntu/+source/postfix/3.4.13-0ubuntu1.3 . A vulnerability in Postfix could be exploited, leading to potential email authentication breaches and increased domain spoofing threats. Update immediately.. Postfix Authentication, Email Spoofing, Ubuntu Update. . LinuxSecurity.com Team
It was discovered that there was an issue in the opendmarc DMARC email filter system. A vulnerability allowed attackers to inject authentication results to provide false information about the domain that originated an email message. This was caused by incorrect . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3546-1
Get the latest Linux and open source security news straight to your inbox.