[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <32345105-4692-465c-9a1d-e668c23df18d@hostland.ru>
Date: Mon, 25 Dec 2023 21:27:37 +0300
From: kai <kai@...tland.ru>
To: oss-security@...ts.openwall.com
Subject: Re: Re: New SMTP smuggling attack
Happy christmas list!
If anyone needs patch for postfix's 3.3.0-1ubuntu0.4
smtpd_forbid_bare_newline feature it has been attached to this message
On 24/12/2023 12.33, Marcus Meissner wrote:
> On Sat, Dec 23, 2023 at 02:29:34PM +0200, Valtteri Vuorikoski wrote:
>> On Fri, Dec 22, 2023 at 11:46:48AM +0100, Marcus Meissner wrote:
>>> Hi,
>>>
>>> FWIW as no CVEs were to be found yet, I filed a CVE request for Postfix now.
>>>
>>> Not sure if we need it for others like sendmail too, as that is also
>>> referenced by the security researchers.
>> Looks like exim opened a bug on this yesterday too, no sign of CVE yet:
>> <https://bugs.exim.org/show_bug.cgi?id=3063>
> CVEs are assigned now for:
>
> - CVE-2023-51764 postfix
> - CVE-2023-51765 sendmail
> - CVE-2023-51766 exim
>
> Ciao, Marcus
View attachment "smtp-smuggling33.patch" of type "text/x-patch" (6395 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
