Description
Sendmail before 8.12.3 on Debian GNU/Linux, when using sasl and sasl-bin, uses a Sendmail configuration script with a fixed username and password, which could allow remote attackers to use Sendmail as an open mail relay and send spam messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sendmail | 8.13.1-13 | — |
| Debian 13 | sendmail | 8.13.1-13 | — |
| Debian 12 | sendmail | 8.13.1-13 | — |
| Debian 3.0 | sendmail | 8.12.3-7.1 | DSA-554-1 |
Advisories 1
- DSA-554-1 sendmail - pre-set password Debian Security (DSA / DLA) · Mar 9, 2026
References
- sendmail-mail-relay(17531) vdb-entry
- 12667 third-party-advisory
- DSA-554 vendor-advisory
- 11262 vdb-entry