CVE-2024-34083 STARTTLS unencrypted commands injection

2024-05-1818:12:19

CWE-349

GitHub_M

github.com

cve-2024-34083

starttls

unencrypted commands

injection

aiosmtpd

asyncio

python

smtpd.py

servers

man-in-the-middle

patch

5.4 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

CNA Affected

[
  {
    "vendor": "aio-libs",
    "product": "aiosmtpd",
    "versions": [
      {
        "version": "< 1.4.6",
        "status": "affected"
      }
    ]
  }
]