Most recent entries from all

ALSA-2024:9243 — Moderate: postfix security update

Affected: AlmaLinux:9: postfix, AlmaLinux:9: postfix-cdb, AlmaLinux:9: postfix-ldap, AlmaLinux:9: postfix-lmdb, AlmaLinux:9: postfix-mysql, AlmaLinux:9: postfix-pcre, AlmaLinux:9: postfix-perl-scripts, AlmaLinux:9: postfix-pgsql, AlmaLinux:9: postfix-sqlite

The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.

Security Fix(es):

* postfix: SMTP smuggling vulnerability (CVE-2023-51764)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-00106

certfr-2024-avi-0058 — Une vulnérabilité a été découverte dans Postfix. Elle permet à un attaquant de provoquer un contournement de la politiq…

certfr-2024-avi-0058

EUVD-2026-260120

fkie_cve-2023-51764

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

GHSA-j5jm-hg4x-w8rx

Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Postfix server, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

gsd-2023-51764

msrc_CVE-2023-51764 — Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and…

msrc_CVE-2023-51764

openSUSE-SU-2024:13538-1 — postfix-3.8.4-2.1 on GA media

postfix-3.8.4-2.1 on GA media

SUSE-SU-2023:4981-1 — Security update for postfix

Security update for postfix

UBUNTU-CVE-2023-51764

Affected: Ubuntu:Pro:14.04:LTS: postfix, Ubuntu:Pro:16.04:LTS: postfix, Ubuntu:Pro:18.04:LTS: postfix, Ubuntu:20.04:LTS: postfix, Ubuntu:22.04:LTS: postfix

WID-SEC-W-2023-3206 — SMTP Implementierungen: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen SMTP Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.