Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9243 advisory.

    The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH     (SASL), and TLS.

    Security Fix(es):

    * postfix: SMTP smuggling vulnerability (CVE-2023-51764)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1149-1 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postfix installed on the remote host is prior to 2.6.6-2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1914 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6591-2 advisory.

    USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of regression has been made available     since the last update. This update updates the fix and aligns with the latest configuration guidelines     regarding this vulnerability.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3725 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-495 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postfix installed on the remote host is prior to 2.10.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2420 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6591-1 advisory.

    Timo Longin discovered that Postfix incorrectly handled certain email line endings. A remote attacker     could possibly use this issue to bypass an email authentication mechanism, allowing domain spoofing and     potential spamming.

    Please note that certain configuration changes are required to address this issue. They are not enabled by     default for backward compatibility. Information can be found at https://www.postfix.org/smtp-     smuggling.html.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postfix installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-51764 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c839e7294f advisory.

    Security fix for CVE-2023-51764.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5c186175f2 advisory.

    Security fix for CVE-2023-51764.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0012-1 advisory.

  - Postfix through 3.8.4 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13,     3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4981-1 advisory.

  - Postfix through 3.8.4 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13,     3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210837	RHEL 9 : postfix (RHSA-2024:9243)	Nessus	Red Hat Local Security Checks	medium
193042	SUSE SLES12 Security Update : postfix (SUSE-SU-2024:1149-1)	Nessus	SuSE Local Security Checks	medium
190039	Amazon Linux AMI : postfix (ALAS-2024-1914)	Nessus	Amazon Linux Local Security Checks	medium
189851	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 : Postfix update (USN-6591-2)	Nessus	Ubuntu Local Security Checks	medium
189772	Debian dla-3725 : postfix - security update	Nessus	Debian Local Security Checks	medium
189351	Amazon Linux 2023 : postfix, postfix-cdb, postfix-ldap (ALAS2023-2024-495)	Nessus	Amazon Linux Local Security Checks	medium
189345	Amazon Linux 2 : postfix (ALAS-2024-2420)	Nessus	Amazon Linux Local Security Checks	medium
189292	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 : Postfix vulnerability (USN-6591-1)	Nessus	Ubuntu Local Security Checks	medium
189277	CBL Mariner 2.0 Security Update: postfix (CVE-2023-51764)	Nessus	MarinerOS Local Security Checks	medium
187928	Fedora 39 : postfix (2024-c839e7294f)	Nessus	Fedora Local Security Checks	medium
187921	Fedora 38 : postfix (2024-5c186175f2)	Nessus	Fedora Local Security Checks	medium
187489	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postfix (SUSE-SU-2024:0012-1)	Nessus	SuSE Local Security Checks	medium
187389	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postfix (SUSE-SU-2023:4981-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-51764

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium