{"id":"CVE-2023-51764","aliases":["ALSA-2024:9243","AZL-32296","AZL-35110","CLSA-2025-1738267482","CLSA-2026-1778834899","CLSA-2026-1778834936","DEBIAN-CVE-2023-51764","DLA-3725-1","EUVD-2023-56453","GHSA-j5jm-hg4x-w8rx","MGASA-2024-0029","RHSA-2024:9243","RLSA-2024:9243","SUSE-SU-2023:4981-1","SUSE-SU-2024:0012-1","SUSE-SU-2024:1149-1","UBUNTU-CVE-2023-51764","USN-6591-1","USN-6591-2","openSUSE-SU-2024:13538-1"],"status":"published","title":"Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions...","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02635,"percentile":0.85748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-345"],"published":"2023-12-24T00:00:00Z","modified":"2026-10-29T11:31:10Z","exploits":[{"source":"pocgithub","id":"Double-q1015/CVE-2023-51764","title":"Double-q1015/CVE-2023-51764","date":"2024-01-05","url":"https://github.com/Double-q1015/CVE-2023-51764"},{"source":"pocgithub","id":"d4op/CVE-2023-51764-POC","title":"d4op/CVE-2023-51764-POC","date":"2023-12-31","url":"https://github.com/d4op/CVE-2023-51764-POC"},{"source":"pocgithub","id":"duy-31/CVE-2023-51764","title":"duy-31/CVE-2023-51764","date":"2023-12-26","url":"https://github.com/duy-31/CVE-2023-51764"},{"source":"pocgithub","id":"eeenvik1/CVE-2023-51764","title":"eeenvik1/CVE-2023-51764","date":"2023-12-28","url":"https://github.com/eeenvik1/CVE-2023-51764"}],"fixes":[{"ecosystem":"AlmaLinux:9","package":"postfix","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-cdb","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-ldap","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-lmdb","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-mysql","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-pcre","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-perl-scripts","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-pgsql","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"postfix-sqlite","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"postfix","fixed_in":["3.7.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"postfix","fixed_in":["3.9.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-cdb","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-ldap","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-lmdb","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-mysql","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-pcre","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-perl-scripts","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-pgsql","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-sqlite","fixed_in":["2:3.5.9-19.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"postfix","fixed_in":["2:2.10.1-9.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"postfix-perl-scripts","fixed_in":["2:2.10.1-9.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"postfix-sysvinit","fixed_in":["2:2.10.1-9.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"postfix","fixed_in":["2:2.10.1-9.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"postfix-perl-scripts","fixed_in":["2:2.10.1-9.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"postfix-sysvinit","fixed_in":["2:2.10.1-9.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"postfix","fixed_in":["3.7.9-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"postfix","fixed_in":["3.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postfix","fixed_in":["3.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"postfix","fixed_in":["3.4.23-0+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"postfix","fixed_in":["3.8.4-1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-cdb","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-cdb-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-debugsource","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-ldap","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-ldap-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-lmdb","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-lmdb-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-mysql","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-mysql-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pcre","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pcre-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-perl-scripts","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pgsql","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pgsql-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-sqlite","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-sqlite-debuginfo","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"postfix","fixed_in":["2:3.5.25-1.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"postfix","fixed_in":["3.7.3-150500.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"postfix-bdb","fixed_in":["3.7.3-150500.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"postfix","fixed_in":["3.7.3-150500.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"postfix","fixed_in":["3.7.3-150500.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"postfix-bdb","fixed_in":["3.7.3-150500.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"postfix","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"postfix-bdb","fixed_in":["3.5.9-150300.5.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"postfix","fixed_in":["3.2.10-3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"postfix","fixed_in":["3.2.10-3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"postfix","fixed_in":["3.2.10-3.30.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postfix","fixed_in":["2.11.0-1ubuntu1.2+esm3","2.11.0-1ubuntu1.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"postfix","fixed_in":["3.1.0-3ubuntu0.4+esm3","3.1.0-3ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfix","fixed_in":["3.3.0-1ubuntu0.4+esm3","3.3.0-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"postfix","fixed_in":["3.4.13-0ubuntu1.4","3.4.13-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"postfix","fixed_in":["3.6.4-1ubuntu1.3","3.6.4-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"postfix","fixed_in":["3.8.4-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-cdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-pcre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-perl-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postfix-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-cdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-pcre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-perl-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"postfix-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.9-19.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.10.1-9.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"postfix-perl-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.10.1-9.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"postfix-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.10.1-9.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.10.1-9.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"postfix-perl-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.10.1-9.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"postfix-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.10.1-9.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-0+deb12u1"}]}],"versions":["3.7.5-2","3.7.6-0+deb12u1","3.7.6-0+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.23-0+deb10u2"}]}],"versions":["3.4.10-0+deb10u1","3.4.10-1","3.4.14-0+deb10u1","3.4.23-0+deb10u1","3.4.5-1","3.4.7-0+deb10u1","3.4.7-1","3.4.7-2","3.4.8-0+10debu1","3.4.8-1","3.4.9-0+10debu1","3.4.9-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-cdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-cdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-lmdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pcre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pcre-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-perl-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postfix-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.5.25-1.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150500.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150500.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150500.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150500.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150500.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"postfix-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-150300.5.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-3.30.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-1ubuntu1.2+esm3"}]}],"versions":["2.10.2-1","2.10.2-1build1","2.11.0-1","2.11.0-1ubuntu1","2.11.0-1ubuntu1.2","2.11.0-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3ubuntu0.4+esm3"}]}],"versions":["2.11.3-1ubuntu2","2.11.3-1ubuntu3","3.0.4-1ubuntu1","3.0.4-2","3.0.4-3","3.0.4-5","3.0.4-5build1","3.1.0-3","3.1.0-3ubuntu0.1","3.1.0-3ubuntu0.2","3.1.0-3ubuntu0.3","3.1.0-3ubuntu0.4","3.1.0-3ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.4+esm3"}]}],"versions":["3.2.3-1","3.2.3-1build1","3.2.4-1","3.2.5-1","3.2.5-1build1","3.3.0-1","3.3.0-1ubuntu0.1","3.3.0-1ubuntu0.2","3.3.0-1ubuntu0.3","3.3.0-1ubuntu0.4","3.3.0-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.13-0ubuntu1.4"}]}],"versions":["3.4.5-1ubuntu1","3.4.7-1","3.4.7-2","3.4.8-1","3.4.9-1","3.4.10-1","3.4.10-1ubuntu1","3.4.13-0ubuntu1","3.4.13-0ubuntu1.1","3.4.13-0ubuntu1.2","3.4.13-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-1ubuntu1.3"}]}],"versions":["3.5.6-1ubuntu2","3.5.13-1ubuntu1","3.5.13-1ubuntu2","3.5.13-1ubuntu3","3.6.3-4ubuntu1","3.6.3-5ubuntu1","3.6.3-5ubuntu2","3.6.4-1ubuntu1","3.6.4-1ubuntu1.1","3.6.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-1ubuntu1.2+esm2"}]}],"versions":["2.10.2-1","2.10.2-1build1","2.11.0-1","2.11.0-1ubuntu1","2.11.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3ubuntu0.4+esm2"}]}],"versions":["2.11.3-1ubuntu2","2.11.3-1ubuntu3","3.0.4-1ubuntu1","3.0.4-2","3.0.4-3","3.0.4-5","3.0.4-5build1","3.1.0-3","3.1.0-3ubuntu0.1","3.1.0-3ubuntu0.2","3.1.0-3ubuntu0.3","3.1.0-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.4+esm2"}]}],"versions":["3.2.3-1","3.2.3-1build1","3.2.4-1","3.2.5-1","3.2.5-1build1","3.3.0-1","3.3.0-1ubuntu0.1","3.3.0-1ubuntu0.2","3.3.0-1ubuntu0.3","3.3.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.13-0ubuntu1.3"}]}],"versions":["3.4.5-1ubuntu1","3.4.7-1","3.4.7-2","3.4.8-1","3.4.9-1","3.4.10-1","3.4.10-1ubuntu1","3.4.13-0ubuntu1","3.4.13-0ubuntu1.1","3.4.13-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-1ubuntu1.2"}]}],"versions":["3.5.6-1ubuntu2","3.5.13-1ubuntu1","3.5.13-1ubuntu2","3.5.13-1ubuntu3","3.6.3-4ubuntu1","3.6.3-5ubuntu1","3.6.3-5ubuntu2","3.6.4-1ubuntu1","3.6.4-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-1ubuntu1.2+esm3"}]}],"versions":["2.10.2-1","2.10.2-1build1","2.11.0-1","2.11.0-1ubuntu1","2.11.0-1ubuntu1.2","2.11.0-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3ubuntu0.4+esm3"}]}],"versions":["2.11.3-1ubuntu2","2.11.3-1ubuntu3","3.0.4-1ubuntu1","3.0.4-2","3.0.4-3","3.0.4-5","3.0.4-5build1","3.1.0-3","3.1.0-3ubuntu0.1","3.1.0-3ubuntu0.2","3.1.0-3ubuntu0.3","3.1.0-3ubuntu0.4","3.1.0-3ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.4+esm3"}]}],"versions":["3.2.3-1","3.2.3-1build1","3.2.4-1","3.2.5-1","3.2.5-1build1","3.3.0-1","3.3.0-1ubuntu0.1","3.3.0-1ubuntu0.2","3.3.0-1ubuntu0.3","3.3.0-1ubuntu0.4","3.3.0-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.13-0ubuntu1.4"}]}],"versions":["3.4.5-1ubuntu1","3.4.7-1","3.4.7-2","3.4.8-1","3.4.9-1","3.4.10-1","3.4.10-1ubuntu1","3.4.13-0ubuntu1","3.4.13-0ubuntu1.1","3.4.13-0ubuntu1.2","3.4.13-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-1ubuntu1.3"}]}],"versions":["3.5.6-1ubuntu2","3.5.13-1ubuntu1","3.5.13-1ubuntu2","3.5.13-1ubuntu3","3.6.3-4ubuntu1","3.6.3-5ubuntu1","3.6.3-5ubuntu2","3.6.4-1ubuntu1","3.6.4-1ubuntu1.1","3.6.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postfix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-2.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"postfix","product":"postfix"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://www.postfix.org/smtp-smuggling.html","tags":["x_transferred","Exploit","Mitigation","Vendor Advisory","evidence","web","article","report"]},{"url":"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/","tags":["x_transferred","Technical Description","Third Party Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/24/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/25/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255563","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51764","tags":["x_transferred","Third Party Advisory","report","advisory"]},{"url":"https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html","tags":["x_transferred","Technical Description","article"]},{"url":"https://github.com/eeenvik1/CVE-2023-51764","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/duy-31/CVE-2023-51764","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.youtube.com/watch?v=V8KPV96g1To","tags":["x_transferred","Exploit","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lwn.net/Articles/956533/","tags":["x_transferred","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/22/1","tags":["x_transferred","web"]},{"url":"https://www.postfix.org/announcements/postfix-3.8.5.html","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/09/3","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51764","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC"},{"url":"https://lwn.net/Articles/956533"},{"url":"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO"},{"url":"https://github.com/advisories/GHSA-j5jm-hg4x-w8rx"},{"url":"https://access.redhat.com/errata/RHSA-2024:9243","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2255563","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9243.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1738267482.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1778834899.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778834936.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-51764","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0029.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32647","tags":["report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9243.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51764","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9243","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234981-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218304","tags":["report"]},{"url":"https://bugzilla.suse.com/1218314","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51764","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240012-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241149-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51764","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/21/6","tags":["report"]},{"url":"https://www.mail-archive.com/postfix-users@postfix.org/msg100901.html","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/22/3","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6591-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6591-2","tags":["advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/2049337","tags":["report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/2050834","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-51764","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T00:00:00Z","modified":"2026-10-08T21:03:31.129Z","updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2023-56453","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T00:00:00Z","modified":"2026-10-08T21:03:31Z","updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-j5jm-hg4x-w8rx","title":"Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions...","description":"Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Postfix server, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T06:30:31Z","modified":"2025-11-05T00:32:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2023-51764","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T05:15:08.273Z","modified":"2026-10-08T21:17:49.743Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"AZL-32296","title":"CVE-2023-51764 affecting package postfix for versions less than 3.7.0-3","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T05:15:08Z","modified":"2026-04-21T04:26:46.050841Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-35110","title":"CVE-2023-51764 affecting package postfix for versions less than 3.9.0-1","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T05:15:08Z","modified":"2026-04-21T04:54:42.354788Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"CVE-2023-51764","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T05:15:08.273Z","modified":"2026-04-16T04:32:28.156999137Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-51764","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T05:15:08.273Z","modified":"2026-10-26T18:01:55.637781786Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"RHSA-2024:9243","title":"Red Hat Security Advisory: postfix security update","status":"published","published":"2024-11-12T18:04:39Z","modified":"2026-06-26T11:20:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:9243","title":"Moderate: postfix security update","description":"The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.\n\nSecurity Fix(es):\n\n* postfix: SMTP smuggling vulnerability (CVE-2023-51764)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2025-10-09T06:18:51.716187Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2023-51764","description":"Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. To prevent attack variants (by always disallowing \u003cLF\u003e without \u003cCR\u003e), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.","status":"published","published":"2023-12-24T05:15:00Z","modified":"2026-04-22T14:15:02.266698Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"ALSA-2024:9243","title":"Moderate: postfix security update","description":"The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.  \n\nSecurity Fix(es):  \n\n  * postfix: SMTP smuggling vulnerability (CVE-2023-51764)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:10.388400053Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2025-1738267482","title":"postfix: Fix of CVE-2023-51764","description":"- CVE-2023-51764: Improvements for inbound SMTP smuggling defense.\n  Reject or restrict input lines from an SMTP client that end in bare new line.\n  Replace each stray \u003cCR\u003e or \u003cLF\u003e character in message\n  content with a space character, to prevent outbound SMTP smuggling\n  To prevent the SMTP smuggling vulnerability, the option \"smtpd_forbid_bare_newline = reject\" must be set.","status":"published","published":"2025-01-30T20:04:49Z","modified":"2026-06-01T00:30:20.768074564Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1778834899","title":"postfix: Fix of CVE-2023-51764","description":"- CVE-2023-51764: fix SMTP smuggling (backport of 2.11.11-smuggling-patch)","status":"published","published":"2026-05-15T08:48:24Z","modified":"2026-06-01T00:33:28.362695963Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778834936","title":"postfix: Fix of CVE-2023-51764","description":"- CVE-2023-51764: fix SMTP smuggling (backport of 2.11.11-smuggling-patch)","status":"published","published":"2026-05-15T08:49:01Z","modified":"2026-06-01T00:33:27.386808604Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3725-1","title":"postfix - security update","status":"published","published":"2024-01-30T00:00:00Z","modified":"2026-03-09T01:18:06.478373Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0029","title":"Updated postfix packages fix a security vulnerability","description":"Postfix has been updated to fix smtp smuggling, an email spoofing attack\nthat involves a composition of email services with specific differences\nin the way they handle line endings other than \u003cCR\u003e\u003cLF\u003e.\n","status":"published","published":"2024-02-09T01:34:03Z","modified":"2026-04-16T04:40:49.981199593Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13538-1","title":"postfix-3.8.4-2.1 on GA media","description":"These are all security issues fixed in the postfix-3.8.4-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:16.218254Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4981-1","title":"Security update for postfix","description":"This update for postfix fixes the following issues:\n\n- CVE-2023-51764: Fixed new SMTP smuggling attack (bsc#1218304).\n","status":"published","published":"2023-12-28T01:41:55Z","modified":"2026-02-04T04:39:25.613724Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:0012-1","title":"Security update for postfix","description":"This update for postfix fixes the following issues:\n\n- CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).\n","status":"published","published":"2024-01-02T15:14:17Z","modified":"2026-02-04T03:23:45.080531Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:1149-1","title":"Security update for postfix","description":"This update for postfix fixes the following issues:\n\n- CVE-2023-51764: Prevent SMTP smuggling attack. (bsc#1218304) \n","status":"published","published":"2024-04-08T09:35:46Z","modified":"2026-02-04T04:26:31.341764Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6591-1","title":"postfix vulnerability","description":"Timo Longin discovered that Postfix incorrectly handled certain email line\nendings. A remote attacker could possibly use this issue to bypass an email\nauthentication mechanism, allowing domain spoofing and potential spamming.\n\nPlease note that certain configuration changes are required to address\nthis issue. They are not enabled by default for backward compatibility.\nInformation can be found at https://www.postfix.org/smtp-smuggling.html.\n","status":"published","published":"2024-01-22T12:35:30Z","modified":"2026-06-29T13:51:00.528284715Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6591-2","title":"postfix update","description":"USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of\nregression has been made available since the last update. This update\nupdates the fix and aligns with the latest configuration guidelines\nregarding this vulnerability.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Timo Longin discovered that Postfix incorrectly handled certain email line\n endings. A remote attacker could possibly use this issue to bypass an email\n authentication mechanism, allowing domain spoofing and potential spamming.\n \n Please note that certain configuration changes are required to address\n this issue. They are not enabled by default for backward compatibility.\n Information can be found at https://www.postfix.org/smtp-smuggling.html.\n","status":"published","published":"2024-01-31T13:34:03Z","modified":"2026-06-29T13:51:00.976484375Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}