Description
sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sendmail | 8.18.1-1 | — |
| Debian 13 | sendmail | 8.18.1-1 | — |
| Debian 12 | sendmail | 8.17.1.9-2+deb12u1 | — |
| Debian 10 | sendmail | 8.15.2-14~deb10u2 | DLA-3829-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | sendmail | No fix yet | — |
| Ubuntu 20.04 LTS | sendmail | No fix yet | — |
| Ubuntu 18.04 LTS | sendmail | No fix yet | — |
| Ubuntu 16.04 LTS | sendmail | No fix yet | — |
| Ubuntu 14.04 LTS | sendmail | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | sendmail | 8.15.2-150000.8.12.1 | SUSE-SU-2024:0743-1 |
| SLES 12 | sendmail | 8.14.9-4.9.1 | SUSE-SU-2024:0742-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | sendmail | 8.15.2-150000.8.12.1 | SUSE-SU-2024:0743-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | sendmail +4 | 8.18.2-2.amzn2023.0.1 | ALAS2023-2026-1818 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | sendmail | No fix yet | — |
Advisories 6
- ALAS2023-2026-1818 Moderate: sendmail security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- DLA-3829-1 sendmail - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2024:0743-1 Security update for sendmail SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0742-1 Security update for sendmail SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2023-3206 SMTP Implementierungen: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 11, 2024
References
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://www.openwall.com/lists/oss-security/2023/12/22/7
- https://www.openwall.com/lists/oss-security/2023/12/21/7
- https://github.com/freebsd/freebsd-src/commit/5dd76dd0cc19450133aa379ce0ce4a68ae07fb39#diff-afdf514b32ac88004952c11660c57bc96c3d8b2234007c1cbd8d7ed7fd7935cc
- [oss-security] 20231224 Re: Re: New SMTP smuggling attack mailing-list
- [oss-security] 20231225 Re: Re: New SMTP smuggling attack mailing-list
- https://bugzilla.suse.com/show_bug.cgi?id=1218351
- https://bugzilla.redhat.com/show_bug.cgi?id=2255869
- https://access.redhat.com/security/cve/CVE-2023-51765
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- [oss-security] 20231226 Re: New SMTP smuggling attack mailing-list
- [oss-security] 20231229 Re: Re: New SMTP smuggling attack mailing-list
- [oss-security] 20231230 Re: Re: New SMTP smuggling attack mailing-list
- [oss-security] 20231230 Re: Re: New SMTP smuggling attack mailing-list
- https://www.youtube.com/watch?v=V8KPV96g1To
- https://lwn.net/Articles/956533/
- [debian-lts-announce] 20240615 [SECURITY] [DLA 3829-1] sendmail security update mailing-list