Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postfix-lmdbUpgrade postfix-sqliteUpgrade postfix-perl-scriptsUpgrade postfix-pcreUpgrade postfix-pgsqlUpgrade postfix-mysqlUpgrade postfixUpgrade postfix-cdbUpgrade postfix-ldap | Nov 19, 2024 | Dec 24, 2023 |
| Amazon Linux Ami 2 | — | Upgrade postfix-perl-scriptsUpgrade postfixUpgrade postfix-debuginfoUpgrade postfix-sysvinit | Jan 23, 2024 | Dec 24, 2023 |
| Amazon_linux | — | Upgrade postfix | Feb 6, 2024 | Dec 24, 2023 |
| Amazon_linux_2023 | — | Upgrade postfix-cdbUpgrade postfix-pgsqlUpgrade postfix-pgsql-debuginfoUpgrade postfix-pcreUpgrade postfix-ldapUpgrade postfix-mysql-debuginfoUpgrade postfix-sqliteUpgrade postfix-sqlite-debuginfoUpgrade postfix-mysqlUpgrade postfix-pcre-debuginfoUpgrade postfix-perl-scriptsUpgrade postfix-lmdb-debuginfoUpgrade postfix-ldap-debuginfoUpgrade postfix-debugsourceUpgrade postfix-lmdbUpgrade postfixUpgrade postfix-cdb-debuginfoUpgrade postfix-debuginfo | Feb 17, 2025 | Dec 18, 2023 |
| Debian | — | Upgrade postfix | Feb 5, 2024 | Dec 24, 2023 |
| Oracle_linux | — | Upgrade postfix-pgsqlUpgrade postfix-mysqlUpgrade postfixUpgrade postfix-perl-scriptsUpgrade postfix-lmdbUpgrade postfix-sqliteUpgrade postfix-cdbUpgrade postfix-pcreUpgrade postfix-ldap | Nov 21, 2024 | Dec 18, 2023 |
| Redhat_linux | — | Upgrade postfix-mysqlUpgrade postfix-lmdbUpgrade postfix-pgsqlUpgrade postfixUpgrade postfix-pcre-debuginfoUpgrade postfix-ldap-debuginfoUpgrade postfix-lmdb-debuginfoNo solution existsUpgrade postfix-sqliteUpgrade postfix-mysql-debuginfoUpgrade postfix-pgsql-debuginfoUpgrade postfix-debuginfoUpgrade postfix-debugsourceUpgrade postfix-sqlite-debuginfoUpgrade postfix-pcreUpgrade postfix-cdbUpgrade postfix-ldapUpgrade postfix-cdb-debuginfo | Nov 13, 2024 | Dec 24, 2023 |
| Rocky_linux | — | Upgrade postfix-debuginfoUpgrade postfix-sqlite-debuginfoUpgrade postfix-cdb-debuginfoUpgrade postfix-debugsourceUpgrade postfixUpgrade postfix-pgsql-debuginfoUpgrade postfix-pcreUpgrade postfix-cdbUpgrade postfix-ldapUpgrade postfix-mysqlUpgrade postfix-mysql-debuginfoUpgrade postfix-ldap-debuginfoUpgrade postfix-sqliteUpgrade postfix-pcre-debuginfoUpgrade postfix-pgsqlUpgrade postfix-lmdb-debuginfoUpgrade postfix-perl-scriptsUpgrade postfix-lmdb | Mar 18, 2025 | Dec 24, 2023 |
| Suse | — | Upgrade postfix-docUpgrade postfixUpgrade postfix-postgresqlUpgrade postfix-bdbUpgrade postfix-bdb-lmdbUpgrade postfix-mysqlUpgrade postfix-ldapUpgrade postfix-devel | Dec 29, 2023 | Dec 24, 2023 |
| Ubuntu | — | Upgrade postfixUpgrade postfix (Ubuntu Pro) | Jan 23, 2024 | Dec 24, 2023 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Jan 10, 2025 | Dec 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub