Summary
Timo Longin discovered that Postfix incorrectly handled certain email line
endings. A remote attacker could possibly use this issue to bypass an email
authentication mechanism, allowing domain spoofing and potential spamming.
Please note that certain configuration changes are required to address
this issue. They are not enabled by default for backward compatibility.
Information can be found at https://www.postfix.org/smtp-smuggling.html.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | postfix | 3.4.13-0ubuntu1.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | postfix | 3.6.4-1ubuntu1.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | postfix | 2.11.0-1ubuntu1.2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | postfix | 3.1.0-3ubuntu0.4+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | postfix | 3.3.0-1ubuntu0.4+esm2 |
Vulnerabilities 1
-
Unscored —CVE-2023-51764 Public exploit
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and…