CVE-2024-27938 (GCVE-0-2024-27938)
Vulnerability from cvelistv5
Published
2024-03-11 21:18
Modified
2024-08-27 19:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Summary
Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has 'authorised' to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with `<CR><LF>` line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly `<CR><LF>.<CR><LF>`. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| postalserver | postal |
Version: < 3.0.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:41:55.742Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2"
},
{
"name": "https://github.com/postalserver/postal/commit/0140dc4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/postalserver/postal/commit/0140dc4"
},
{
"name": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide"
},
{
"name": "https://www.postfix.org/smtp-smuggling.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.postfix.org/smtp-smuggling.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:postalserver:postal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "postal",
"vendor": "postalserver",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-27T19:45:59.549699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T19:48:22.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "postal",
"vendor": "postalserver",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has \u0027authorised\u0027 to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with `\u003cCR\u003e\u003cLF\u003e` line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly `\u003cCR\u003e\u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e`. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-11T21:18:14.988Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2"
},
{
"name": "https://github.com/postalserver/postal/commit/0140dc4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/postalserver/postal/commit/0140dc4"
},
{
"name": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide",
"tags": [
"x_refsource_MISC"
],
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide"
},
{
"name": "https://www.postfix.org/smtp-smuggling.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.postfix.org/smtp-smuggling.html"
}
],
"source": {
"advisory": "GHSA-j42r-6c99-hqf2",
"discovery": "UNKNOWN"
},
"title": "SMTP Smuggling in Postal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-27938",
"datePublished": "2024-03-11T21:18:14.988Z",
"dateReserved": "2024-02-28T15:14:14.217Z",
"dateUpdated": "2024-08-27T19:48:22.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2\", \"name\": \"https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/postalserver/postal/commit/0140dc4\", \"name\": \"https://github.com/postalserver/postal/commit/0140dc4\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide\", \"name\": \"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.postfix.org/smtp-smuggling.html\", \"name\": \"https://www.postfix.org/smtp-smuggling.html\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:41:55.742Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27938\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-27T19:45:59.549699Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:postalserver:postal:*:*:*:*:*:*:*:*\"], \"vendor\": \"postalserver\", \"product\": \"postal\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.0.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-27T19:48:17.945Z\"}}], \"cna\": {\"title\": \"SMTP Smuggling in Postal\", \"source\": {\"advisory\": \"GHSA-j42r-6c99-hqf2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"postalserver\", \"product\": \"postal\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2\", \"name\": \"https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/postalserver/postal/commit/0140dc4\", \"name\": \"https://github.com/postalserver/postal/commit/0140dc4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide\", \"name\": \"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.postfix.org/smtp-smuggling.html\", \"name\": \"https://www.postfix.org/smtp-smuggling.html\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has \u0027authorised\u0027 to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with `\u003cCR\u003e\u003cLF\u003e` line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly `\u003cCR\u003e\u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e`. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-116\", \"description\": \"CWE-116: Improper Encoding or Escaping of Output\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-03-11T21:18:14.988Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-27938\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-27T19:48:22.783Z\", \"dateReserved\": \"2024-02-28T15:14:14.217Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-03-11T21:18:14.988Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…