Vulnerability · Published Dec 24, 2023 · Assigned by mitre
CVE-2023-51766
Medium 5.3
In plain English
A medium-severity security flaw in the exim package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | exim | 4.97.1-r0 | ALPINE-CVE-2023-51766 |
| Alpine:v3.21 | exim | 4.97.1-r0 | ALPINE-CVE-2023-51766 |
| Alpine:v3.22 | exim | 4.97.1-r0 | ALPINE-CVE-2023-51766 |
| Alpine:v3.23 | exim | 4.97.1-r0 | ALPINE-CVE-2023-51766 |
| Alpine:v3.24 | exim | 4.97.1-r0 | ALPINE-CVE-2023-51766 |
| Debian:12 | exim4 | 4.96-15+deb12u4 | DSA-5597-1 |
| Debian:12 | exim4 | 4.96-15+deb12u4 | DEBIAN-CVE-2023-51766 |
| Debian:13 | exim4 | 4.97-3 | DEBIAN-CVE-2023-51766 |
| Debian:14 | exim4 | 4.97-3 | DEBIAN-CVE-2023-51766 |
| Ubuntu:22.04:LTS | exim4 | 4.95-4ubuntu2.5 | UBUNTU-CVE-2023-51766 |
| Ubuntu:22.04:LTS | exim4 | 4.95-4ubuntu2.5 | USN-6611-1 |
Affected products (as reported)
References
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://exim.org/static/doc/security/CVE-2023-51766.txt
- https://bugs.exim.org/show_bug.cgi?id=3063
- https://www.openwall.com/lists/oss-security/2023/12/23/2
- [oss-security] 20231224 Re: Re: New SMTP smuggling attack mailing-list
- [oss-security] 20231225 Re: Re: New SMTP smuggling attack mailing-list
- https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca
- https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5
- https://bugzilla.redhat.com/show_bug.cgi?id=2255852
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- [oss-security] 20231229 CVE-2023-51766: Exim: SMTP smuggling mailing-list
- https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766
- [oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling mailing-list
- [oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling mailing-list
- [oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling mailing-list
- https://www.youtube.com/watch?v=V8KPV96g1To
- [debian-lts-announce] 20240105 [SECURITY] [DLA 3708-1] exim4 security update mailing-list
- FEDORA-2024-1ef6197a49 vendor-advisory
- FEDORA-2024-e0841c83bb vendor-advisory
- https://lwn.net/Articles/956533/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/