Vulnerability · Published Dec 24, 2023 · Assigned by mitre
CVE-2023-51764
Medium 5.3
In plain English
A medium-severity security flaw in the postfix package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | postfix | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-cdb | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-ldap | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-lmdb | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-mysql | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-pcre | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-perl-scripts | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-pgsql | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| AlmaLinux:9 | postfix-sqlite | 2:3.5.25-1.el9 | ALSA-2024:9243 |
| Debian:12 | postfix | 3.7.9-0+deb12u1 | DEBIAN-CVE-2023-51764 |
| Debian:13 | postfix | 3.8.4-1 | DEBIAN-CVE-2023-51764 |
| Debian:14 | postfix | 3.8.4-1 | DEBIAN-CVE-2023-51764 |
| Rocky Linux:9 | postfix | 2:3.5.25-1.el9 | RLSA-2024:9243 |
| Ubuntu:22.04:LTS | postfix | 3.6.4-1ubuntu1.2 | USN-6591-1 |
| Ubuntu:22.04:LTS | postfix | 3.6.4-1ubuntu1.3 | USN-6591-2 |
| Ubuntu:22.04:LTS | postfix | 3.6.4-1ubuntu1.3 | UBUNTU-CVE-2023-51764 |
Affected products (as reported)
References
- https://www.postfix.org/smtp-smuggling.html
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- [oss-security] 20231224 Re: Re: New SMTP smuggling attack mailing-list
- [oss-security] 20231225 Re: Re: New SMTP smuggling attack mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=2255563
- https://access.redhat.com/security/cve/CVE-2023-51764
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- https://github.com/eeenvik1/CVE-2023-51764
- https://github.com/duy-31/CVE-2023-51764
- https://www.youtube.com/watch?v=V8KPV96g1To
- FEDORA-2024-c839e7294f vendor-advisory
- FEDORA-2024-5c186175f2 vendor-advisory
- https://lwn.net/Articles/956533/
- https://www.openwall.com/lists/oss-security/2024/01/22/1
- https://www.postfix.org/announcements/postfix-3.8.5.html
- [debian-lts-announce] 20240130 [SECURITY] [DLA 3725-1] postfix security update mailing-list
- [oss-security] 20240508 Re: New SMTP smuggling attack mailing-list
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/