{"id":"CVE-2023-51765","aliases":["AZL-32295","DEBIAN-CVE-2023-51765","DLA-3829-1","EUVD-2023-56454","GHSA-5rcq-25vc-g8qr","MGASA-2024-0270","SUSE-SU-2024:0742-1","SUSE-SU-2024:0743-1","UBUNTU-CVE-2023-51765","openSUSE-SU-2024:13658-1"],"status":"published","title":"sendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote...","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01082,"percentile":0.65603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2023-12-24T00:00:00Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Debian:12","package":"sendmail","fixed_in":["8.17.1.9-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sendmail","fixed_in":["8.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sendmail","fixed_in":["8.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"sendmail","fixed_in":["8.15.2-14~deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"sendmail","fixed_in":["8.17.1-4.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"sendmail","fixed_in":["8.14.9-4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"sendmail","fixed_in":["8.15.2-150000.8.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"sendmail","fixed_in":["8.15.2-150000.8.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"sendmail","fixed_in":["8.15.2-150000.8.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.15.2-46"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.1.9-2+deb12u1"}]}],"versions":["8.17.1.9-2"]},{"source":"osv","ecosystem":"Debian:13","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-14~deb10u2"}]}],"versions":["8.15.2-12","8.15.2-13","8.15.2-14~deb10u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.1-4.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.9-4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.4-2.1ubuntu4","8.14.4-2.1ubuntu5","8.14.4-4.1ubuntu1","8.14.4-4.1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.9-4","8.15.2-2","8.15.2-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.15.2-8ubuntu1","8.15.2-9ubuntu1","8.15.2-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.15.2-13","8.15.2-17ubuntu1","8.15.2-18"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.15.2-22ubuntu2","8.15.2-22ubuntu3"]}],"products":[{"vendor":"freebsd","product":"freebsd"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"sendmail","product":"sendmail"}],"references":[{"url":"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/","tags":["x_transferred","Technical Description","Third Party Advisory","article","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/22/7","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/21/7","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://github.com/freebsd/freebsd-src/commit/5dd76dd0cc19450133aa379ce0ce4a68ae07fb39#diff-afdf514b32ac88004952c11660c57bc96c3d8b2234007c1cbd8d7ed7fd7935cc","tags":["x_transferred","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/24/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/25/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1218351","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255869","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51765","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html","tags":["x_transferred","Technical Description","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/26/5","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/5","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/30/3","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/30/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://www.youtube.com/watch?v=V8KPV96g1To","tags":["x_transferred","Exploit","web"]},{"url":"https://lwn.net/Articles/956533/","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00004.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51765","tags":["web","advisory"]},{"url":"https://lwn.net/Articles/956533"},{"url":"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide"},{"url":"https://github.com/advisories/GHSA-5rcq-25vc-g8qr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51765.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-51765","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0270.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32700","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/21/6","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/26/5","tags":["web","report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240742-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51765","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240743-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51765","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51765","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-51765","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T00:00:00Z","modified":"2024-08-02T22:48:11.197Z","updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2023-56454","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T00:00:00Z","modified":"2024-08-02T22:48:11Z","updated_at":"2026-11-03T03:26:07.206777Z"}],"ghsa":[{"id":"GHSA-5rcq-25vc-g8qr","title":"sendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote...","description":"sendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the sendmail server, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not.","status":"published","published":"2023-12-24T06:30:32Z","modified":"2024-06-15T09:31:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:57:29.798871Z"}],"nvd":[{"id":"CVE-2023-51765","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T06:15:07.527Z","modified":"2026-06-17T06:41:36.883Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"AZL-32295","title":"CVE-2023-51765 affecting package sendmail 8.15.2-46","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T06:15:07Z","modified":"2026-04-21T04:26:45.409925Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"DEBIAN-CVE-2023-51765","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T06:15:07.527Z","modified":"2026-10-26T18:01:56.628042421Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"UBUNTU-CVE-2023-51765","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T06:15:00Z","modified":"2026-04-22T14:15:49.613762Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CVE-2023-51765","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.","status":"published","published":"2023-12-24T00:00:00Z","modified":"2026-10-28T02:30:31.500119082Z","updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DLA-3829-1","title":"sendmail - security update","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-03-09T01:20:37.038106Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0270","title":"Updated sendmail packages fix security vulnerability","description":"sendmail through 8.17.2 allows SMTP smuggling in certain configurations.\nRemote attackers can use a published exploitation technique to inject\ne-mail messages with a spoofed MAIL FROM address, allowing bypass of an\nSPF protection mechanism. This occurs because sendmail supports\n\u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not. This is\nresolved in 8.18 and later versions with 'o' in srv_features.\n(CVE-2023-51765)\n","status":"published","published":"2024-07-16T03:21:38Z","modified":"2026-04-16T04:44:44.576726758Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13658-1","title":"libmilter-doc-8.18.1-1.1 on GA media","description":"These are all security issues fixed in the libmilter-doc-8.18.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:55.55207Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0742-1","title":"Security update for sendmail","description":"This update for sendmail fixes the following issues:\n\n- CVE-2023-51765: Fixed new SMTP smuggling attack. (bsc#1218351)\n","status":"published","published":"2024-03-01T20:41:08Z","modified":"2026-02-04T02:51:27.150545Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0743-1","title":"Security update for sendmail","description":"This update for sendmail fixes the following issues:\n\n- CVE-2023-51765: Fixed new SMTP smuggling attack. (bsc#1218351)\n","status":"published","published":"2024-03-01T20:44:59Z","modified":"2026-02-04T04:27:30.370496Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}