CVE-2011-0411
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6...
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
Exploit likelihood
What each source reports
NVD Score used
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
- Record
CVE-2011-0411- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
- Record
CVE-2011-0411- Updated
- 2026-11-02
EUVDEUVD-2011-0437 No score
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
- Record
EUVD-2011-0437- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2gf2-4wwm-4cm6 No score
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6...
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
- Record
GHSA-2gf2-4wwm-4cm6- Updated
- 2026-11-02
OSV No score
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
- Record
CVE-2011-0411- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-0411 No score
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.
- Record
DEBIAN-CVE-2011-0411- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10318-1 No score
pure-ftpd-1.0.43-1.3 on GA media
These are all security issues fixed in the pure-ftpd-1.0.43-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10318-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postfixDebian:12 |
before 2.8.0-1 | 2.8.0-1 |
postfixDebian:13 |
before 2.8.0-1 | 2.8.0-1 |
postfixDebian:14 |
before 2.8.0-1 | 2.8.0-1 |
postfixDebian:5.0 |
before 2.5.5-1.1+lenny1, plus listed versions 2.5.5-1.1 |
2.5.5-1.1+lenny1 |
postfixDebian:6.0 |
before 2.7.1-1+squeeze1, plus listed versions 2.7.1-1 |
2.7.1-1+squeeze1 |
postfixRed Hat:enterprise_linux:4::as |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-debuginfoRed Hat:enterprise_linux:4::as |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-pflogsummRed Hat:enterprise_linux:4::as |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfixRed Hat:enterprise_linux:4::desktop |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-debuginfoRed Hat:enterprise_linux:4::desktop |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postfix-pflogsummRed Hat:enterprise_linux:4::desktop |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfixRed Hat:enterprise_linux:4::es |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-debuginfoRed Hat:enterprise_linux:4::es |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-pflogsummRed Hat:enterprise_linux:4::es |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfixRed Hat:enterprise_linux:4::ws |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-debuginfoRed Hat:enterprise_linux:4::ws |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfix-pflogsummRed Hat:enterprise_linux:4::ws |
before 2:2.2.10-1.4.el4 | 2:2.2.10-1.4.el4 |
postfixRed Hat:enterprise_linux:5::server |
before 2:2.3.3-2.2.el5_6 | 2:2.3.3-2.2.el5_6 |
postfix-debuginfoRed Hat:enterprise_linux:5::server |
before 2:2.3.3-2.2.el5_6 | 2:2.3.3-2.2.el5_6 |
postfix-pflogsummRed Hat:enterprise_linux:5::server |
before 2:2.3.3-2.2.el5_6 | 2:2.3.3-2.2.el5_6 |
postfixRed Hat:enterprise_linux:6::client |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-debuginfoRed Hat:enterprise_linux:6::client |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-perl-scriptsRed Hat:enterprise_linux:6::client |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfixRed Hat:enterprise_linux:6::computenode |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-debuginfoRed Hat:enterprise_linux:6::computenode |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-perl-scriptsRed Hat:enterprise_linux:6::computenode |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfixRed Hat:enterprise_linux:6::server |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-debuginfoRed Hat:enterprise_linux:6::server |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-perl-scriptsRed Hat:enterprise_linux:6::server |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfixRed Hat:enterprise_linux:6::workstation |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-debuginfoRed Hat:enterprise_linux:6::workstation |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
postfix-perl-scriptsRed Hat:enterprise_linux:6::workstation |
before 2:2.6.6-2.1.el6_0 | 2:2.6.6-2.1.el6_0 |
pure-ftpdopenSUSE:Tumbleweed |
before 1.0.43-1.3 | 1.0.43-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0411 is a medium vulnerability (CVSS 6.8) in Postfix, published March 16, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.3%, the 96th percentile. Fixed in postfix 2.8.0-1.
References
oracle.com/technetwork/topics/security/cpuapr2011-301950.html
exchange.xforce.ibmcloud.com/vulnerabilities/65932
postfix.org/CVE-2011-0411.html
secunia.com/advisories/43646
lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
osvdb.org/71021
Show 35 moreShow less
vupen.com/english/advisories/2011/0752
security.gentoo.org/glsa/glsa-201206-33.xml
lists.fedoraproject.org/pipermail/package-announce/2011-March/056560.html
kb.cert.org/vuls/id/MORO-8ELH6Z
lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
securityfocus.com/bid/46767
redhat.com/support/errata/RHSA-2011-0423.html
securitytracker.com/id?1025179
support.apple.com/kb/HT5002
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
debian.org/security/2011/dsa-2233
openwall.com/lists/oss-security/2021/08/10/2
nvd.nist.gov/vuln/detail/CVE-2011-0411
github.com/advisories/GHSA-2gf2-4wwm-4cm6
security-tracker.debian.org/tracker/CVE-2011-0411
access.redhat.com/errata/RHSA-2011:0422
bugzilla.redhat.com/show_bug.cgi?id=456347
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0422.json
cve.org/CVERecord?id=CVE-2008-2937
suse.com/security/cve/CVE-2011-0411