Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postfix-pgsqlUpgrade postfix-lmdbUpgrade postfix-sqliteUpgrade postfix-pcreUpgrade postfix-perl-scriptsUpgrade postfix-ldapUpgrade postfixUpgrade postfix-cdbUpgrade postfix-mysql | Nov 19, 2024 | Dec 24, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postfix-sysvinitUpgrade postfix-perl-scriptsUpgrade postfixUpgrade postfix-debuginfo | Jan 23, 2024 | Dec 24, 2023 |
| Amazon_linux | — | Upgrade postfix | Feb 6, 2024 | Dec 24, 2023 |
| Amazon_linux_2023 | — | Upgrade postfix-pcre-debuginfoUpgrade postfix-lmdb-debuginfoUpgrade postfix-cdb-debuginfoUpgrade postfixUpgrade postfix-debuginfoUpgrade postfix-mysqlUpgrade postfix-sqlite-debuginfoUpgrade postfix-debugsourceUpgrade postfix-ldap-debuginfoUpgrade postfix-perl-scriptsUpgrade postfix-lmdbUpgrade postfix-sqliteUpgrade postfix-pgsql-debuginfoUpgrade postfix-pgsqlUpgrade postfix-pcreUpgrade postfix-cdbUpgrade postfix-ldapUpgrade postfix-mysql-debuginfo | Feb 17, 2025 | Dec 18, 2023 |
| Debian | — | Upgrade postfix | Feb 5, 2024 | Dec 24, 2023 |
| Oracle_linux | — | Upgrade postfix-sqliteUpgrade postfix-ldapUpgrade postfix-cdbUpgrade postfix-pcreUpgrade postfixUpgrade postfix-mysqlUpgrade postfix-pgsqlUpgrade postfix-perl-scriptsUpgrade postfix-lmdb | Nov 21, 2024 | Dec 18, 2023 |
| Redhat_linux | — | Upgrade postfix-lmdbUpgrade postfix-mysqlUpgrade postfix-perl-scriptsUpgrade postfix-mysql-debuginfoNo solution existsUpgrade postfix-pgsqlUpgrade postfixUpgrade postfix-ldap-debuginfoUpgrade postfix-lmdb-debuginfoUpgrade postfix-pcre-debuginfoUpgrade postfix-sqliteUpgrade postfix-cdb-debuginfoUpgrade postfix-debugsourceUpgrade postfix-pcreUpgrade postfix-debuginfoUpgrade postfix-pgsql-debuginfoUpgrade postfix-cdbUpgrade postfix-ldapUpgrade postfix-sqlite-debuginfo | Nov 13, 2024 | Dec 24, 2023 |
| Rocky_linux | — | Upgrade postfix-sqlite-debuginfoUpgrade postfix-debugsourceUpgrade postfixUpgrade postfix-cdb-debuginfoUpgrade postfix-cdbUpgrade postfix-debuginfoUpgrade postfix-pcreUpgrade postfix-pgsql-debuginfoUpgrade postfix-ldapUpgrade postfix-lmdbUpgrade postfix-lmdb-debuginfoUpgrade postfix-mysql-debuginfoUpgrade postfix-mysqlUpgrade postfix-pcre-debuginfoUpgrade postfix-pgsqlUpgrade postfix-sqliteUpgrade postfix-ldap-debuginfoUpgrade postfix-perl-scripts | Mar 18, 2025 | Dec 24, 2023 |
| Suse | — | Upgrade postfixUpgrade postfix-postgresqlUpgrade postfix-docUpgrade postfix-mysqlUpgrade postfix-develUpgrade postfix-ldapUpgrade postfix-bdb-lmdbUpgrade postfix-bdb | Dec 29, 2023 | Dec 24, 2023 |
| Ubuntu | — | Upgrade postfixUpgrade postfix (Ubuntu Pro) | Jan 23, 2024 | Dec 24, 2023 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 10, 2025 | Dec 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub