Description
Postfix 2.1.3, when /proc/net/if_inet6 is not available and permit_mx_backup is enabled in smtpd_recipient_restrictions, allows remote attackers to bypass e-mail restrictions and perform mail relaying by sending mail to an IPv6 hostname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postfix | 2.1.4-5 | — |
| Debian 13 | postfix | 2.1.4-5 | — |
| Debian 12 | postfix | 2.1.4-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | postfix +1 | 2:2.1.5-4.2.RHEL4 | RHSA-2005:152 |
Advisories 1
- RHSA-2005:152 Red Hat Security Advisory: postfix security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2005:152 vendor-advisory
- 12445 vdb-entry
- 20050204 [USN-74-1] Postfix vulnerability mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=267837
- postfix-ipv6-security-bypass(19218) vdb-entry
- 14137 third-party-advisory
- oval:org.mitre.oval:def:11339 vdb-entry signature