Bug 2281505 (CVE-2024-34083) - CVE-2024-34083 aiosmtpd: servers based on aiosmtpd accept extra unencrypted commands
Summary: CVE-2024-34083 aiosmtpd: servers based on aiosmtpd accept extra unencrypted c...
Keywords:
Status: NEW
Alias: CVE-2024-34083
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2281506 2281507
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-05-19 15:05 UTC by ybuenos
Modified: 2024-05-19 15:07 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description ybuenos 2024-05-19 15:05:43 UTC 
aiosmptd is  a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda
https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8
https://nostarttls.secvuln.info
Comment 1 ybuenos 2024-05-19 15:06:02 UTC 
Created python-aiosmtpd tracking bugs for this issue:

Affects: epel-7 [bug 2281506]
Affects: fedora-all [bug 2281507]
Note You need to log in before you can comment on or make changes to this bug.