Every CVE Search/ Get API key

CVE-2024-34083

STARTTLS unencrypted commands injection

5.4 MediumFix available

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.23%Up 0.2 points since May 19, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.4

STARTTLS unencrypted commands injection

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Record
CVE-2024-34083
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-349
Updated
2026-11-02
EUVDEUVD-2024-1830 5.4

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Record
EUVD-2024-1830
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-wgjv-9j3q-jhg8 5.4

aiosmtpd STARTTLS unencrypted commands injection

Summary

Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.

References

Record
GHSA-wgjv-9j3q-jhg8
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-349
Updated
2026-11-02
NVD 5.4

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Record
CVE-2024-34083
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-349
Updated
2026-11-02
OSV 5.4

STARTTLS unencrypted commands injection

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Record
CVE-2024-34083
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-349
Updated
2026-11-02
OSVDEBIAN-CVE-2024-34083 5.4

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Record
DEBIAN-CVE-2024-34083
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-wgjv-9j3q-jhg8 5.4

aiosmtpd STARTTLS unencrypted commands injection

Summary

Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.

References

Record
GHSA-wgjv-9j3q-jhg8
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-349
Updated
2026-11-02
OSVOESA-2024-1695 5.4

python-aiosmtpd security update

This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3.

Security Fix(es):

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.(CVE-2024-34083)

Record
OESA-2024-1695
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2024-1696 5.4

python-aiosmtpd security update

This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3.

Security Fix(es):

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.(CVE-2024-34083)

Record
OESA-2024-1696
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2026-1111 5.4

aiosmtpd STARTTLS unencrypted commands injection

Summary

Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.

References

Record
PYSEC-2026-1111
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-34083 5.4

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Record
UBUNTU-CVE-2024-34083
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:0243-1 No score

Security update for python-aiosmtpd

This update for python-aiosmtpd fixes the following issues:

  • CVE-2024-34083: Fixed MiTM attack could inject extra unencrypted commands after STARTTLS (boo#1224467)
  • CVE-2024-27305: Fixed SMTP smuggling (boo#1221328)
Record
openSUSE-SU-2024:0243-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13984-1 No score

python310-aiosmtpd-1.4.6-1.1 on GA media

These are all security issues fixed in the python310-aiosmtpd-1.4.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13984-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11675-1 No score

python313-aiosmtpd-1.4.6-6.1 on GA media

These are all security issues fixed in the python313-aiosmtpd-1.4.6-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11675-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aiosmtpd
PyPI
 before 1.4.6
1.4.6
python-aiosmtpd
Debian:12
 before 1.4.3-1.1+deb12u1, plus listed versions
1.4.3-1.1
1.4.3-1.1+deb12u1
python-aiosmtpd
Debian:13
 before 1.4.6-1
1.4.6-1
python-aiosmtpd
Debian:14
 before 1.4.6-1
1.4.6-1
aiosmtpd
PyPI
 before 1.4.6, plus listed versions
1.01.0a11.0a21.0a31.0a4
Show 20 moreShow less
1.0a51.0b11.0rc11.11.21.2.21.2.41.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.3rc11.4.3rc21.4.41.4.4.post11.4.4.post21.4.5
1.4.6
python-aiosmtpd
openEuler:22.03-LTS-SP1
 before 1.4.6-1.oe2203sp1
1.4.6-1.oe2203sp1
python-aiosmtpd
openEuler:22.03-LTS-SP3
 before 1.4.6-1.oe2203sp3
1.4.6-1.oe2203sp3
python-aiosmtpd
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1-31.1-41.1-5
 None known
python-aiosmtpd
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2-3
 None known
python-aiosmtpd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.4.2-3
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
python-aiosmtpd
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.4.3-1.11.4.4.post2-1
 None known
python-aiosmtpd
Ubuntu:25.10
 All versions, plus listed versions
1.4.6-5
 None known
python-aiosmtpd
Ubuntu:26.10
 All versions, plus listed versions
1.4.6-61.4.6-7
 None known
python-aiosmtpd
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.4.6-51.4.6-6
 None known
python-aiosmtpd
SUSE:Package Hub 15 SP5
From an advisory covering 2 CVEs
 before 1.2.1-bp155.3.3.1
1.2.1-bp155.3.3.1
python-aiosmtpd
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.2.1-bp155.3.3.1
1.2.1-bp155.3.3.1
python-aiosmtpd
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.4.6-6.1
1.4.6-6.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34083 is a medium vulnerability (CVSS 5.4) in Aio-libs Aiosmtpd, published May 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in aiosmtpd 1.4.6.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open