CVE-2023-51766

2023-12-2406:15:07

Debian Security Bug Tracker

security-tracker.debian.org

exim

smtp smuggling

spoofed address

spf protection

e-mail servers

security vulnerability

6.6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.0%

JSON

Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.

OSVersionArchitecturePackageVersionFilename
Debian12allexim4< 4.96-15+deb12u4exim4_4.96-15+deb12u4_all.deb
Debian11allexim4< 4.94.2-7+deb11u2exim4_4.94.2-7+deb11u2_all.deb
Debian10allexim4< 4.92-8+deb10u9exim4_4.92-8+deb10u9_all.deb
Debian999allexim4< 4.97-3exim4_4.97-3_all.deb
Debian13allexim4< 4.97-3exim4_4.97-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	exim4	< 4.96-15+deb12u4	exim4_4.96-15+deb12u4_all.deb
Debian	11	all	exim4	< 4.94.2-7+deb11u2	exim4_4.94.2-7+deb11u2_all.deb
Debian	10	all	exim4	< 4.92-8+deb10u9	exim4_4.92-8+deb10u9_all.deb
Debian	999	all	exim4	< 4.97-3	exim4_4.97-3_all.deb
Debian	13	all	exim4	< 4.97-3	exim4_4.97-3_all.deb