CVE-2023-51764

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-51764
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/12/24/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/25/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/09/3
https://access.redhat.com/security/cve/CVE-2023-51764 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2255563 Issue Tracking Third Party Advisory
https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html Technical Description
https://github.com/duy-31/CVE-2023-51764 Exploit Third Party Advisory
https://github.com/eeenvik1/CVE-2023-51764 Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/
https://lwn.net/Articles/956533/
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Technical Description Third Party Advisory
https://www.openwall.com/lists/oss-security/2024/01/22/1
https://www.postfix.org/announcements/postfix-3.8.5.html
https://www.postfix.org/smtp-smuggling.html Exploit Mitigation Vendor Advisory
https://www.youtube.com/watch?v=V8KPV96g1To Exploit
http://www.openwall.com/lists/oss-security/2023/12/24/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/25/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/09/3
https://access.redhat.com/security/cve/CVE-2023-51764 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2255563 Issue Tracking Third Party Advisory
https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html Technical Description
https://github.com/duy-31/CVE-2023-51764 Exploit Third Party Advisory
https://github.com/eeenvik1/CVE-2023-51764 Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/
https://lwn.net/Articles/956533/
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Technical Description Third Party Advisory
https://www.openwall.com/lists/oss-security/2024/01/22/1
https://www.postfix.org/announcements/postfix-3.8.5.html
https://www.postfix.org/smtp-smuggling.html Exploit Mitigation Vendor Advisory
https://www.youtube.com/watch?v=V8KPV96g1To Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:38

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/12/24/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/12/24/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/12/25/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/12/25/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/09/3 - () http://www.openwall.com/lists/oss-security/2024/05/09/3 -
References () https://access.redhat.com/security/cve/CVE-2023-51764 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-51764 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2255563 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2255563 - Issue Tracking, Third Party Advisory
References () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html - Technical Description () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html - Technical Description
References () https://github.com/duy-31/CVE-2023-51764 - Exploit, Third Party Advisory () https://github.com/duy-31/CVE-2023-51764 - Exploit, Third Party Advisory
References () https://github.com/eeenvik1/CVE-2023-51764 - Exploit, Third Party Advisory () https://github.com/eeenvik1/CVE-2023-51764 - Exploit, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/ -
References () https://lwn.net/Articles/956533/ - () https://lwn.net/Articles/956533/ -
References () https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ - Technical Description, Third Party Advisory () https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ - Technical Description, Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2024/01/22/1 - () https://www.openwall.com/lists/oss-security/2024/01/22/1 -
References () https://www.postfix.org/announcements/postfix-3.8.5.html - () https://www.postfix.org/announcements/postfix-3.8.5.html -
References () https://www.postfix.org/smtp-smuggling.html - Exploit, Mitigation, Vendor Advisory () https://www.postfix.org/smtp-smuggling.html - Exploit, Mitigation, Vendor Advisory
References () https://www.youtube.com/watch?v=V8KPV96g1To - Exploit () https://www.youtube.com/watch?v=V8KPV96g1To - Exploit

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/05/09/3 -

30 Jan 2024, 14:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html -

22 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://lwn.net/Articles/956533/ -
  • () https://www.openwall.com/lists/oss-security/2024/01/22/1 -
  • () https://www.postfix.org/announcements/postfix-3.8.5.html -
Summary (en) Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9. (en) Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

11 Jan 2024, 04:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/ -

11 Jan 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/ -

05 Jan 2024, 16:19

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/12/24/1 - () http://www.openwall.com/lists/oss-security/2023/12/24/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/12/25/1 - () http://www.openwall.com/lists/oss-security/2023/12/25/1 - Mailing List, Third Party Advisory
References () https://access.redhat.com/security/cve/CVE-2023-51764 - () https://access.redhat.com/security/cve/CVE-2023-51764 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2255563 - () https://bugzilla.redhat.com/show_bug.cgi?id=2255563 - Issue Tracking, Third Party Advisory
References () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html - () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html - Technical Description
References () https://github.com/duy-31/CVE-2023-51764 - () https://github.com/duy-31/CVE-2023-51764 - Exploit, Third Party Advisory
References () https://github.com/eeenvik1/CVE-2023-51764 - () https://github.com/eeenvik1/CVE-2023-51764 - Exploit, Third Party Advisory
References () https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ - () https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ - Technical Description, Third Party Advisory
References () https://www.postfix.org/smtp-smuggling.html - () https://www.postfix.org/smtp-smuggling.html - Exploit, Mitigation, Vendor Advisory
References () https://www.youtube.com/watch?v=V8KPV96g1To - () https://www.youtube.com/watch?v=V8KPV96g1To - Exploit
First Time Postfix postfix
Fedoraproject fedora
Redhat enterprise Linux
Redhat
Postfix
Fedoraproject
CPE cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-345

04 Jan 2024, 18:15

Type Values Removed Values Added
References
  • () https://www.youtube.com/watch?v=V8KPV96g1To -

29 Dec 2023, 02:15

Type Values Removed Values Added
References
  • () https://github.com/duy-31/CVE-2023-51764 -
  • () https://github.com/eeenvik1/CVE-2023-51764 -

26 Dec 2023, 21:15

Type Values Removed Values Added
References
  • () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html -

26 Dec 2023, 16:15

Type Values Removed Values Added
Summary
  • (es) Postfix hasta 3.8.4 permite el contrabando SMTP a menos que se configure con smtpd_data_restrictions=reject_unauth_pipelining (u otras opciones que existen en versiones recientes). Los atacantes remotos pueden utilizar una técnica de explotación publicada para inyectar mensajes de correo electrónico que parecen originarse en el servidor Postfix, lo que permite omitir un mecanismo de protección SPF. Esto ocurre porque Postfix admite . pero algunos otros servidores de correo electrónico populares no lo hacen. Para evitar variantes de ataque (al no permitir siempre sin ), se requiere una solución diferente: la opción smtpd_forbid_bare_newline=yes con una versión mínima de Postfix de 3.5.23, 3.6.13, 3.7.9, 3.8.4, o 3.9.
Summary (en) Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Postfix server, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9. (en) Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
References
  • () http://www.openwall.com/lists/oss-security/2023/12/25/1 -
  • () https://access.redhat.com/security/cve/CVE-2023-51764 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2255563 -

24 Dec 2023, 12:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2023/12/24/1 -

24 Dec 2023, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-24 05:15

Updated : 2024-11-21 08:38

NVD link : CVE-2023-51764

Mitre link : CVE-2023-51764

CVE.ORG link : CVE-2023-51764

JSON object : View

Products Affected

postfix

  • postfix

redhat

  • enterprise_linux

fedoraproject

  • fedora
CWE
CWE-345

Insufficient Verification of Data Authenticity