1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
sendmail (8.18.1-3) unstable; urgency=medium
Sendmail was affected by SMTP smuggling (CVE-2023-51765).
Remote attackers can use a published exploitation technique
to inject e-mail messages with a spoofed MAIL FROM address,
allowing bypass of an SPF protection mechanism.
This occurs because sendmail supports some combinaison of
<CR><LF><NUL>.
.
This particular injection vulnerability has been closed,
unfortunately full closure need to reject mail that
contain NUL.
.
This is slighly non conformant with RFC and could
be opt-out by setting confREJECT_NUL to 'false'
in sendmail.mc file.
-- Bastien Roucariès <rouca@debian.org> Sun, 12 May 2024 19:38:09 +0000
|
