Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-51766 (GCVE-0-2023-51766)
Vulnerability from cvelistv5
Published
2023-12-24 00:00
Modified
2024-08-02 22:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:48:11.092Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"tags": [
"x_transferred"
],
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"name": "[oss-security] 20231224 Re: Re: New SMTP smuggling attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"name": "[oss-security] 20231225 Re: Re: New SMTP smuggling attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"tags": [
"x_transferred"
],
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"name": "[oss-security] 20231229 CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
},
{
"name": "[debian-lts-announce] 20240105 [SECURITY] [DLA 3708-1] exim4 security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"name": "FEDORA-2024-1ef6197a49",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/"
},
{
"name": "FEDORA-2024-e0841c83bb",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lwn.net/Articles/956533/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-18T02:47:22.078412",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"name": "[oss-security] 20231224 Re: Re: New SMTP smuggling attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"name": "[oss-security] 20231225 Re: Re: New SMTP smuggling attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"name": "[oss-security] 20231229 CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
},
{
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
},
{
"name": "[debian-lts-announce] 20240105 [SECURITY] [DLA 3708-1] exim4 security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"name": "FEDORA-2024-1ef6197a49",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/"
},
{
"name": "FEDORA-2024-e0841c83bb",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/"
},
{
"url": "https://lwn.net/Articles/956533/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-51766",
"datePublished": "2023-12-24T00:00:00",
"dateReserved": "2023-12-24T00:00:00",
"dateUpdated": "2024-08-02T22:48:11.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-51766\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-12-24T06:15:07.673\",\"lastModified\":\"2024-11-21T08:38:45.183\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not.\"},{\"lang\":\"es\",\"value\":\"Exim hasta 4.97 permite el contrabando SMTP en ciertas configuraciones. Los atacantes remotos pueden utilizar una t\u00e9cnica de explotaci\u00f3n publicada para inyectar mensajes de correo electr\u00f3nico que parecen originarse en el servidor Exim, permitiendo omitir un mecanismo de protecci\u00f3n SPF. Esto ocurre porque Exim admite . pero algunos otros servidores de correo electr\u00f3nico populares no lo hacen.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.97.1\",\"matchCriteriaId\":\"95F6F151-E57F-4DB2-9CCD-3336B887A07B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D9C7598-4BB4-442A-86DF-EEDE041A4CC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB176AC3-3CDA-4DDA-9089-C67B2F73AA62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C30C1AC-01E4-4D7C-B03A-8EEEF3FC8C2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/24/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/25/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/29/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/01/01/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/01/01/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/01/01/3\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://bugs.exim.org/show_bug.cgi?id=3063\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2255852\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://exim.org/static/doc/security/CVE-2023-51766.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lwn.net/Articles/956533/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"https://www.openwall.com/lists/oss-security/2023/12/23/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.youtube.com/watch?v=V8KPV96g1To\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/24/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/25/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/29/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/01/01/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/01/01/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/01/01/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://bugs.exim.org/show_bug.cgi?id=3063\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2255852\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://exim.org/static/doc/security/CVE-2023-51766.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lwn.net/Articles/956533/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"https://www.openwall.com/lists/oss-security/2023/12/23/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.youtube.com/watch?v=V8KPV96g1To\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]}]}}"
}
}
ghsa-w6ww-869j-cgm6
Vulnerability from github
Published
2023-12-24 06:30
Modified
2024-01-04 18:30
Severity ?
VLAI Severity ?
Details
Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.
{
"affected": [],
"aliases": [
"CVE-2023-51766"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-24T06:15:07Z",
"severity": "MODERATE"
},
"details": "Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not.",
"id": "GHSA-w6ww-869j-cgm6",
"modified": "2024-01-04T18:30:20Z",
"published": "2023-12-24T06:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51766"
},
{
"type": "WEB",
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"type": "WEB",
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"type": "WEB",
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"type": "WEB",
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"type": "WEB",
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ"
},
{
"type": "WEB",
"url": "https://lwn.net/Articles/956533"
},
{
"type": "WEB",
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
fkie_cve-2023-51766
Vulnerability from fkie_nvd
Published
2023-12-24 06:15
Modified
2024-11-21 08:38
Severity ?
Summary
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| exim | exim | * | |
| fedoraproject | extra_packages_for_enterprise_linux | 7.0 | |
| fedoraproject | extra_packages_for_enterprise_linux | 8.0 | |
| fedoraproject | extra_packages_for_enterprise_linux | 9.0 | |
| fedoraproject | fedora | 38 | |
| fedoraproject | fedora | 39 | |
| debian | debian_linux | 10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"matchCriteriaId": "95F6F151-E57F-4DB2-9CCD-3336B887A07B",
"versionEndExcluding": "4.97.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3D9C7598-4BB4-442A-86DF-EEDE041A4CC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB176AC3-3CDA-4DDA-9089-C67B2F73AA62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C30C1AC-01E4-4D7C-B03A-8EEEF3FC8C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not."
},
{
"lang": "es",
"value": "Exim hasta 4.97 permite el contrabando SMTP en ciertas configuraciones. Los atacantes remotos pueden utilizar una t\u00e9cnica de explotaci\u00f3n publicada para inyectar mensajes de correo electr\u00f3nico que parecen originarse en el servidor Exim, permitiendo omitir un mecanismo de protecci\u00f3n SPF. Esto ocurre porque Exim admite . pero algunos otros servidores de correo electr\u00f3nico populares no lo hacen."
}
],
"id": "CVE-2023-51766",
"lastModified": "2024-11-21T08:38:45.183",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-12-24T06:15:07.673",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Mitigation",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Technical Description"
],
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lwn.net/Articles/956533/"
},
{
"source": "cve@mitre.org",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Mitigation",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Technical Description"
],
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lwn.net/Articles/956533/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-345"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
WID-SEC-W-2023-3206
Vulnerability from csaf_certbund
Published
2023-12-21 23:00
Modified
2024-11-11 23:00
Summary
SMTP Implementierungen: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Postfix ist ein Open Source Email Server für Linux und unix-basierte Betriebssysteme.
Sendmail ist ein Mail Transfer Agent für UNIX-Betriebssysteme.
Exim (EXperimental Internet Mailer) ist ein Mailserver und Mail Transfer Agent.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen SMTP Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
- UNIX
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Postfix ist ein Open Source Email Server f\u00fcr Linux und unix-basierte Betriebssysteme.\r\nSendmail ist ein Mail Transfer Agent f\u00fcr UNIX-Betriebssysteme.\r\nExim (EXperimental Internet Mailer) ist ein Mailserver und Mail Transfer Agent.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen SMTP Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-3206 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3206.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-3206 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3206"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3708 vom 2024-01-05",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6611-1 vom 2024-01-29",
"url": "https://ubuntu.com/security/notices/USN-6611-1"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3725 vom 2024-01-30",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6591-2 vom 2024-01-31",
"url": "https://ubuntu.com/security/notices/USN-6591-2"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2024-1914 vom 2024-02-06",
"url": "https://alas.aws.amazon.com/ALAS-2024-1914.html"
},
{
"category": "external",
"summary": "Red Hat Bugzilla vom 2023-12-21",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255563"
},
{
"category": "external",
"summary": "SECConsult Blog vom 2023-12-21",
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"category": "external",
"summary": "Postfix Patch vom 2023-12-21",
"url": "https://www.mail-archive.com/postfix-users@postfix.org/msg100901.html"
},
{
"category": "external",
"summary": "Github Advisory Database vom 2023-12-21",
"url": "https://github.com/advisories/GHSA-j5jm-hg4x-w8rx"
},
{
"category": "external",
"summary": "Red Hat Bugzilla vom 2023-12-27",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"category": "external",
"summary": "Red Hat Bugzilla vom 2023-12-27",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255869"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2023:4981-1 vom 2023-12-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017566.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2024-1908 vom 2024-01-23",
"url": "https://alas.aws.amazon.com/ALAS-2024-1908.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2024-2420 vom 2024-01-23",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2420.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6591-1 vom 2024-01-22",
"url": "https://ubuntu.com/security/notices/USN-6591-1"
},
{
"category": "external",
"summary": "Postfix Advisory vom 2024-01-22",
"url": "https://www.postfix.org/smtp-smuggling.html"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-C839E7294F vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-c839e7294f"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-5C186175F2 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-5c186175f2"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0012-1 vom 2024-01-02",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-January/017584.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0743-1 vom 2024-03-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-March/018086.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0742-1 vom 2024-03-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-March/018087.html"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-EPEL-2024-8EB8988CB8 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8eb8988cb8"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-EPEL-2024-9BC09085C7 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-9bc09085c7"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-1EF6197A49 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ef6197a49"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-E0841C83BB vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-e0841c83bb"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-EPEL-2024-54A5C04D0C vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-54a5c04d0c"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-5597 vom 2024-01-04",
"url": "https://lists.debian.org/debian-security-announce/2024/msg00004.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1149-1 vom 2024-04-08",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018274.html"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7148150 vom 2024-04-11",
"url": "https://aix.software.ibm.com/aix/efixes/security/sendmail_advisory4.asc"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3829 vom 2024-06-15",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00004.html"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2024-348 vom 2024-08-06",
"url": "https://www.dell.com/support/kbdoc/de-de/000227573/dsa-2024-348-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-security-update-for-multiple-vulnerabilities"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:9243 vom 2024-11-12",
"url": "https://access.redhat.com/errata/RHSA-2024:9243"
}
],
"source_lang": "en-US",
"title": "SMTP Implementierungen: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
"tracking": {
"current_release_date": "2024-11-11T23:00:00.000+00:00",
"generator": {
"date": "2024-11-12T12:17:22.693+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2023-3206",
"initial_release_date": "2023-12-21T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-12-21T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-12-26T23:00:00.000+00:00",
"number": "2",
"summary": "CVEs und Quellen erg\u00e4nzt."
},
{
"date": "2023-12-27T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-01-02T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Fedora und SUSE aufgenommen"
},
{
"date": "2024-01-03T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Fedora aufgenommen"
},
{
"date": "2024-01-04T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-01-07T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-01-22T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Amazon und Postfix aufgenommen"
},
{
"date": "2024-01-28T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-01-30T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-01-31T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-02-05T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2024-03-03T23:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-04-08T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-04-11T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2024-06-16T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-08-05T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Dell aufgenommen"
},
{
"date": "2024-11-11T23:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "18"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Dell NetWorker",
"product": {
"name": "Dell NetWorker",
"product_id": "T024663",
"product_identification_helper": {
"cpe": "cpe:/a:dell:networker:-"
}
}
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"category": "product_name",
"name": "EMC Avamar",
"product": {
"name": "EMC Avamar",
"product_id": "T014381",
"product_identification_helper": {
"cpe": "cpe:/a:emc:avamar:-"
}
}
}
],
"category": "vendor",
"name": "EMC"
},
{
"branches": [
{
"category": "product_name",
"name": "Fedora Linux",
"product": {
"name": "Fedora Linux",
"product_id": "74185",
"product_identification_helper": {
"cpe": "cpe:/o:fedoraproject:fedora:-"
}
}
}
],
"category": "vendor",
"name": "Fedora"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "7.3",
"product": {
"name": "IBM AIX 7.3",
"product_id": "1139691",
"product_identification_helper": {
"cpe": "cpe:/o:ibm:aix:7.3"
}
}
},
{
"category": "product_version",
"name": "7.2",
"product": {
"name": "IBM AIX 7.2",
"product_id": "434967",
"product_identification_helper": {
"cpe": "cpe:/o:ibm:aix:7.2"
}
}
}
],
"category": "product_name",
"name": "AIX"
},
{
"branches": [
{
"category": "product_version",
"name": "3.1",
"product": {
"name": "IBM VIOS 3.1",
"product_id": "1039165",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:vios:3.1"
}
}
},
{
"category": "product_version",
"name": "4.1",
"product": {
"name": "IBM VIOS 4.1",
"product_id": "1522854",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:vios:4.1"
}
}
}
],
"category": "product_name",
"name": "VIOS"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source Exim",
"product": {
"name": "Open Source Exim",
"product_id": "T007959",
"product_identification_helper": {
"cpe": "cpe:/a:exim:exim:-"
}
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c3.9",
"product": {
"name": "Open Source Postfix \u003c3.9",
"product_id": "T031802"
}
},
{
"category": "product_version",
"name": "3.9",
"product": {
"name": "Open Source Postfix 3.9",
"product_id": "T031802-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:postfix:postfix:3.9"
}
}
}
],
"category": "product_name",
"name": "Postfix"
},
{
"category": "product_name",
"name": "Open Source sendmail",
"product": {
"name": "Open Source sendmail",
"product_id": "T031803",
"product_identification_helper": {
"cpe": "cpe:/a:sendmail:sendmail:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-51764",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in verschiedenen SMTP Implementierungen. Je nachdem, wie SMTP-Server/Software konfiguriert sind, um die End-of-Data-Sequenz zu interpretieren (z. B. CR+LF.CR+LF), kann ein Angreifer aus den Nachrichtendaten ausbrechen und SMTP-Befehle \"einschmuggeln\", um gef\u00e4lschte E-Mails zu versenden, die die SPF-Pr\u00fcfungen umgehen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
}
],
"product_status": {
"known_affected": [
"67646",
"434967",
"T007959",
"1039165",
"1522854",
"74185",
"1139691",
"T014381",
"2951",
"T002207",
"T000126",
"T024663",
"T031803",
"T031802",
"398363"
]
},
"release_date": "2023-12-21T23:00:00.000+00:00",
"title": "CVE-2023-51764"
},
{
"cve": "CVE-2023-51765",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in verschiedenen SMTP Implementierungen. Je nachdem, wie SMTP-Server/Software konfiguriert sind, um die End-of-Data-Sequenz zu interpretieren (z. B. CR+LF.CR+LF), kann ein Angreifer aus den Nachrichtendaten ausbrechen und SMTP-Befehle \"einschmuggeln\", um gef\u00e4lschte E-Mails zu versenden, die die SPF-Pr\u00fcfungen umgehen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
}
],
"product_status": {
"known_affected": [
"67646",
"434967",
"T007959",
"1039165",
"1522854",
"74185",
"1139691",
"T014381",
"2951",
"T002207",
"T000126",
"T024663",
"T031803",
"T031802",
"398363"
]
},
"release_date": "2023-12-21T23:00:00.000+00:00",
"title": "CVE-2023-51765"
},
{
"cve": "CVE-2023-51766",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in verschiedenen SMTP Implementierungen. Je nachdem, wie SMTP-Server/Software konfiguriert sind, um die End-of-Data-Sequenz zu interpretieren (z. B. CR+LF.CR+LF), kann ein Angreifer aus den Nachrichtendaten ausbrechen und SMTP-Befehle \"einschmuggeln\", um gef\u00e4lschte E-Mails zu versenden, die die SPF-Pr\u00fcfungen umgehen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
}
],
"product_status": {
"known_affected": [
"67646",
"434967",
"T007959",
"1039165",
"1522854",
"74185",
"1139691",
"T014381",
"2951",
"T002207",
"T000126",
"T024663",
"T031803",
"T031802",
"398363"
]
},
"release_date": "2023-12-21T23:00:00.000+00:00",
"title": "CVE-2023-51766"
}
]
}
wid-sec-w-2023-3206
Vulnerability from csaf_certbund
Published
2023-12-21 23:00
Modified
2024-11-11 23:00
Summary
SMTP Implementierungen: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Postfix ist ein Open Source Email Server für Linux und unix-basierte Betriebssysteme.
Sendmail ist ein Mail Transfer Agent für UNIX-Betriebssysteme.
Exim (EXperimental Internet Mailer) ist ein Mailserver und Mail Transfer Agent.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen SMTP Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
- UNIX
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Postfix ist ein Open Source Email Server f\u00fcr Linux und unix-basierte Betriebssysteme.\r\nSendmail ist ein Mail Transfer Agent f\u00fcr UNIX-Betriebssysteme.\r\nExim (EXperimental Internet Mailer) ist ein Mailserver und Mail Transfer Agent.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen SMTP Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-3206 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3206.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-3206 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3206"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3708 vom 2024-01-05",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6611-1 vom 2024-01-29",
"url": "https://ubuntu.com/security/notices/USN-6611-1"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3725 vom 2024-01-30",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6591-2 vom 2024-01-31",
"url": "https://ubuntu.com/security/notices/USN-6591-2"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2024-1914 vom 2024-02-06",
"url": "https://alas.aws.amazon.com/ALAS-2024-1914.html"
},
{
"category": "external",
"summary": "Red Hat Bugzilla vom 2023-12-21",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255563"
},
{
"category": "external",
"summary": "SECConsult Blog vom 2023-12-21",
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"category": "external",
"summary": "Postfix Patch vom 2023-12-21",
"url": "https://www.mail-archive.com/postfix-users@postfix.org/msg100901.html"
},
{
"category": "external",
"summary": "Github Advisory Database vom 2023-12-21",
"url": "https://github.com/advisories/GHSA-j5jm-hg4x-w8rx"
},
{
"category": "external",
"summary": "Red Hat Bugzilla vom 2023-12-27",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"category": "external",
"summary": "Red Hat Bugzilla vom 2023-12-27",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255869"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2023:4981-1 vom 2023-12-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017566.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2024-1908 vom 2024-01-23",
"url": "https://alas.aws.amazon.com/ALAS-2024-1908.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2024-2420 vom 2024-01-23",
"url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2420.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6591-1 vom 2024-01-22",
"url": "https://ubuntu.com/security/notices/USN-6591-1"
},
{
"category": "external",
"summary": "Postfix Advisory vom 2024-01-22",
"url": "https://www.postfix.org/smtp-smuggling.html"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-C839E7294F vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-c839e7294f"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-5C186175F2 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-5c186175f2"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0012-1 vom 2024-01-02",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-January/017584.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0743-1 vom 2024-03-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-March/018086.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0742-1 vom 2024-03-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-March/018087.html"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-EPEL-2024-8EB8988CB8 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8eb8988cb8"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-EPEL-2024-9BC09085C7 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-9bc09085c7"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-1EF6197A49 vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ef6197a49"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2024-E0841C83BB vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-e0841c83bb"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-EPEL-2024-54A5C04D0C vom 2024-01-03",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-54a5c04d0c"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-5597 vom 2024-01-04",
"url": "https://lists.debian.org/debian-security-announce/2024/msg00004.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1149-1 vom 2024-04-08",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018274.html"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7148150 vom 2024-04-11",
"url": "https://aix.software.ibm.com/aix/efixes/security/sendmail_advisory4.asc"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-3829 vom 2024-06-15",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00004.html"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2024-348 vom 2024-08-06",
"url": "https://www.dell.com/support/kbdoc/de-de/000227573/dsa-2024-348-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-security-update-for-multiple-vulnerabilities"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:9243 vom 2024-11-12",
"url": "https://access.redhat.com/errata/RHSA-2024:9243"
}
],
"source_lang": "en-US",
"title": "SMTP Implementierungen: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
"tracking": {
"current_release_date": "2024-11-11T23:00:00.000+00:00",
"generator": {
"date": "2024-11-12T12:17:22.693+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2023-3206",
"initial_release_date": "2023-12-21T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-12-21T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-12-26T23:00:00.000+00:00",
"number": "2",
"summary": "CVEs und Quellen erg\u00e4nzt."
},
{
"date": "2023-12-27T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-01-02T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Fedora und SUSE aufgenommen"
},
{
"date": "2024-01-03T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Fedora aufgenommen"
},
{
"date": "2024-01-04T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-01-07T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-01-22T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Amazon und Postfix aufgenommen"
},
{
"date": "2024-01-28T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-01-30T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-01-31T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2024-02-05T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2024-03-03T23:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-04-08T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-04-11T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2024-06-16T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2024-08-05T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Dell aufgenommen"
},
{
"date": "2024-11-11T23:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "18"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Dell NetWorker",
"product": {
"name": "Dell NetWorker",
"product_id": "T024663",
"product_identification_helper": {
"cpe": "cpe:/a:dell:networker:-"
}
}
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"category": "product_name",
"name": "EMC Avamar",
"product": {
"name": "EMC Avamar",
"product_id": "T014381",
"product_identification_helper": {
"cpe": "cpe:/a:emc:avamar:-"
}
}
}
],
"category": "vendor",
"name": "EMC"
},
{
"branches": [
{
"category": "product_name",
"name": "Fedora Linux",
"product": {
"name": "Fedora Linux",
"product_id": "74185",
"product_identification_helper": {
"cpe": "cpe:/o:fedoraproject:fedora:-"
}
}
}
],
"category": "vendor",
"name": "Fedora"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "7.3",
"product": {
"name": "IBM AIX 7.3",
"product_id": "1139691",
"product_identification_helper": {
"cpe": "cpe:/o:ibm:aix:7.3"
}
}
},
{
"category": "product_version",
"name": "7.2",
"product": {
"name": "IBM AIX 7.2",
"product_id": "434967",
"product_identification_helper": {
"cpe": "cpe:/o:ibm:aix:7.2"
}
}
}
],
"category": "product_name",
"name": "AIX"
},
{
"branches": [
{
"category": "product_version",
"name": "3.1",
"product": {
"name": "IBM VIOS 3.1",
"product_id": "1039165",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:vios:3.1"
}
}
},
{
"category": "product_version",
"name": "4.1",
"product": {
"name": "IBM VIOS 4.1",
"product_id": "1522854",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:vios:4.1"
}
}
}
],
"category": "product_name",
"name": "VIOS"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source Exim",
"product": {
"name": "Open Source Exim",
"product_id": "T007959",
"product_identification_helper": {
"cpe": "cpe:/a:exim:exim:-"
}
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c3.9",
"product": {
"name": "Open Source Postfix \u003c3.9",
"product_id": "T031802"
}
},
{
"category": "product_version",
"name": "3.9",
"product": {
"name": "Open Source Postfix 3.9",
"product_id": "T031802-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:postfix:postfix:3.9"
}
}
}
],
"category": "product_name",
"name": "Postfix"
},
{
"category": "product_name",
"name": "Open Source sendmail",
"product": {
"name": "Open Source sendmail",
"product_id": "T031803",
"product_identification_helper": {
"cpe": "cpe:/a:sendmail:sendmail:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-51764",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in verschiedenen SMTP Implementierungen. Je nachdem, wie SMTP-Server/Software konfiguriert sind, um die End-of-Data-Sequenz zu interpretieren (z. B. CR+LF.CR+LF), kann ein Angreifer aus den Nachrichtendaten ausbrechen und SMTP-Befehle \"einschmuggeln\", um gef\u00e4lschte E-Mails zu versenden, die die SPF-Pr\u00fcfungen umgehen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
}
],
"product_status": {
"known_affected": [
"67646",
"434967",
"T007959",
"1039165",
"1522854",
"74185",
"1139691",
"T014381",
"2951",
"T002207",
"T000126",
"T024663",
"T031803",
"T031802",
"398363"
]
},
"release_date": "2023-12-21T23:00:00.000+00:00",
"title": "CVE-2023-51764"
},
{
"cve": "CVE-2023-51765",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in verschiedenen SMTP Implementierungen. Je nachdem, wie SMTP-Server/Software konfiguriert sind, um die End-of-Data-Sequenz zu interpretieren (z. B. CR+LF.CR+LF), kann ein Angreifer aus den Nachrichtendaten ausbrechen und SMTP-Befehle \"einschmuggeln\", um gef\u00e4lschte E-Mails zu versenden, die die SPF-Pr\u00fcfungen umgehen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
}
],
"product_status": {
"known_affected": [
"67646",
"434967",
"T007959",
"1039165",
"1522854",
"74185",
"1139691",
"T014381",
"2951",
"T002207",
"T000126",
"T024663",
"T031803",
"T031802",
"398363"
]
},
"release_date": "2023-12-21T23:00:00.000+00:00",
"title": "CVE-2023-51765"
},
{
"cve": "CVE-2023-51766",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in verschiedenen SMTP Implementierungen. Je nachdem, wie SMTP-Server/Software konfiguriert sind, um die End-of-Data-Sequenz zu interpretieren (z. B. CR+LF.CR+LF), kann ein Angreifer aus den Nachrichtendaten ausbrechen und SMTP-Befehle \"einschmuggeln\", um gef\u00e4lschte E-Mails zu versenden, die die SPF-Pr\u00fcfungen umgehen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
}
],
"product_status": {
"known_affected": [
"67646",
"434967",
"T007959",
"1039165",
"1522854",
"74185",
"1139691",
"T014381",
"2951",
"T002207",
"T000126",
"T024663",
"T031803",
"T031802",
"398363"
]
},
"release_date": "2023-12-21T23:00:00.000+00:00",
"title": "CVE-2023-51766"
}
]
}
gsd-2023-51766
Vulnerability from gsd
Modified
2023-12-25 06:01
Details
Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
Aliases
{
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-51766"
],
"details": "Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not.",
"id": "GSD-2023-51766",
"modified": "2023-12-25T06:01:53.023560Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2023-51766",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/",
"refsource": "MISC",
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"name": "https://exim.org/static/doc/security/CVE-2023-51766.txt",
"refsource": "MISC",
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"name": "https://bugs.exim.org/show_bug.cgi?id=3063",
"refsource": "MISC",
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"name": "https://www.openwall.com/lists/oss-security/2023/12/23/2",
"refsource": "MISC",
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"name": "[oss-security] 20231224 Re: Re: New SMTP smuggling attack",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"name": "[oss-security] 20231225 Re: Re: New SMTP smuggling attack",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"name": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca",
"refsource": "MISC",
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"name": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5",
"refsource": "MISC",
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"name": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html",
"refsource": "MISC",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"name": "[oss-security] 20231229 CVE-2023-51766: Exim: SMTP smuggling",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"name": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766",
"refsource": "CONFIRM",
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"name": "[oss-security] 20240101 Re: CVE-2023-51766: Exim: SMTP smuggling",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
},
{
"name": "https://www.youtube.com/watch?v=V8KPV96g1To",
"refsource": "MISC",
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
},
{
"name": "[debian-lts-announce] 20240105 [SECURITY] [DLA 3708-1] exim4 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"name": "FEDORA-2024-1ef6197a49",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/"
},
{
"name": "FEDORA-2024-e0841c83bb",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/"
},
{
"name": "https://lwn.net/Articles/956533/",
"refsource": "MISC",
"url": "https://lwn.net/Articles/956533/"
}
]
}
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
"matchCriteriaId": "95F6F151-E57F-4DB2-9CCD-3336B887A07B",
"versionEndExcluding": "4.97.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3D9C7598-4BB4-442A-86DF-EEDE041A4CC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB176AC3-3CDA-4DDA-9089-C67B2F73AA62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C30C1AC-01E4-4D7C-B03A-8EEEF3FC8C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not."
},
{
"lang": "es",
"value": "Exim hasta 4.97 permite el contrabando SMTP en ciertas configuraciones. Los atacantes remotos pueden utilizar una t\u00e9cnica de explotaci\u00f3n publicada para inyectar mensajes de correo electr\u00f3nico que parecen originarse en el servidor Exim, permitiendo omitir un mecanismo de protecci\u00f3n SPF. Esto ocurre porque Exim admite . pero algunos otros servidores de correo electr\u00f3nico populares no lo hacen."
}
],
"id": "CVE-2023-51766",
"lastModified": "2024-02-02T02:22:45.693",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-12-24T06:15:07.673",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/24/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/25/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Mitigation",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/29/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/01/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugs.exim.org/show_bug.cgi?id=3063"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://exim.org/static/doc/security/CVE-2023-51766.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Technical Description"
],
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5"
},
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lwn.net/Articles/956533/"
},
{
"source": "cve@mitre.org",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2023/12/23/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://www.youtube.com/watch?v=V8KPV96g1To"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-345"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
opensuse-su-2024:13543-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
exim-4.97.1-1.1 on GA media
Notes
Title of the patch
exim-4.97.1-1.1 on GA media
Description of the patch
These are all security issues fixed in the exim-4.97.1-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-13543
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "exim-4.97.1-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the exim-4.97.1-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13543",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13543-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-51766 page",
"url": "https://www.suse.com/security/cve/CVE-2023-51766/"
}
],
"title": "exim-4.97.1-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13543-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-1.1.aarch64",
"product": {
"name": "exim-4.97.1-1.1.aarch64",
"product_id": "exim-4.97.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-1.1.aarch64",
"product": {
"name": "eximon-4.97.1-1.1.aarch64",
"product_id": "eximon-4.97.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-1.1.aarch64",
"product": {
"name": "eximstats-html-4.97.1-1.1.aarch64",
"product_id": "eximstats-html-4.97.1-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-1.1.ppc64le",
"product": {
"name": "exim-4.97.1-1.1.ppc64le",
"product_id": "exim-4.97.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-1.1.ppc64le",
"product": {
"name": "eximon-4.97.1-1.1.ppc64le",
"product_id": "eximon-4.97.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-1.1.ppc64le",
"product": {
"name": "eximstats-html-4.97.1-1.1.ppc64le",
"product_id": "eximstats-html-4.97.1-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-1.1.s390x",
"product": {
"name": "exim-4.97.1-1.1.s390x",
"product_id": "exim-4.97.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-1.1.s390x",
"product": {
"name": "eximon-4.97.1-1.1.s390x",
"product_id": "eximon-4.97.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-1.1.s390x",
"product": {
"name": "eximstats-html-4.97.1-1.1.s390x",
"product_id": "eximstats-html-4.97.1-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-1.1.x86_64",
"product": {
"name": "exim-4.97.1-1.1.x86_64",
"product_id": "exim-4.97.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-1.1.x86_64",
"product": {
"name": "eximon-4.97.1-1.1.x86_64",
"product_id": "eximon-4.97.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-1.1.x86_64",
"product": {
"name": "eximstats-html-4.97.1-1.1.x86_64",
"product_id": "eximstats-html-4.97.1-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:exim-4.97.1-1.1.aarch64"
},
"product_reference": "exim-4.97.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:exim-4.97.1-1.1.ppc64le"
},
"product_reference": "exim-4.97.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:exim-4.97.1-1.1.s390x"
},
"product_reference": "exim-4.97.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:exim-4.97.1-1.1.x86_64"
},
"product_reference": "exim-4.97.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximon-4.97.1-1.1.aarch64"
},
"product_reference": "eximon-4.97.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximon-4.97.1-1.1.ppc64le"
},
"product_reference": "eximon-4.97.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximon-4.97.1-1.1.s390x"
},
"product_reference": "eximon-4.97.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximon-4.97.1-1.1.x86_64"
},
"product_reference": "eximon-4.97.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.aarch64"
},
"product_reference": "eximstats-html-4.97.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.ppc64le"
},
"product_reference": "eximstats-html-4.97.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.s390x"
},
"product_reference": "eximstats-html-4.97.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.x86_64"
},
"product_reference": "eximstats-html-4.97.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-51766",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-51766"
}
],
"notes": [
{
"category": "general",
"text": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:exim-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:exim-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:exim-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:exim-4.97.1-1.1.x86_64",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.x86_64",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-51766",
"url": "https://www.suse.com/security/cve/CVE-2023-51766"
},
{
"category": "external",
"summary": "SUSE Bug 1218387 for CVE-2023-51766",
"url": "https://bugzilla.suse.com/1218387"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:exim-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:exim-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:exim-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:exim-4.97.1-1.1.x86_64",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.x86_64",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:exim-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:exim-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:exim-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:exim-4.97.1-1.1.x86_64",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:eximon-4.97.1-1.1.x86_64",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.aarch64",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.ppc64le",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.s390x",
"openSUSE Tumbleweed:eximstats-html-4.97.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2023-51766"
}
]
}
opensuse-su-2024:0007-1
Vulnerability from csaf_opensuse
Published
2024-01-03 20:12
Modified
2024-01-03 20:12
Summary
Security update for exim
Notes
Title of the patch
Security update for exim
Description of the patch
This update for exim fixes the following issues:
exim was updated to 4.97.1 (boo#1218387, CVE-2023-51766):
* Fixes for the smtp protocol smuggling (CVE-2023-51766)
exim was updated to exim 4.96:
* Move from using the pcre library to pcre2.
* Constification work in the filters module required a major version
bump for the local-scan API. Specifically, the 'headers_charset'
global which is visible via the API is now const and may therefore
not be modified by local-scan code.
* Bug 2819: speed up command-line messages being read in. Previously a
time check was being done for every character; replace that with one
per buffer.
* Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string
sent was prefixed with a length byte.
* Change the SMTP feature name for pipelining connect to be compliant with
RFC 5321. Previously Dovecot (at least) would log errors during
submission.
* Fix macro-definition during '-be' expansion testing. The move to
write-protected store for macros had not accounted for these runtime
additions; fix by removing this protection for '-be' mode.
* Convert all uses of select() to poll().
* Fix use of $sender_host_name in daemon process. When used in certain
main-section options or in a connect ACL, the value from the first ever
connection was never replaced for subsequent connections.
* Bug 2838: Fix for i32lp64 hard-align platforms
* Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value
with underbars is given.
* Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters.
* Debugging initiated by an ACL control now continues through into routing
and transport processes.
* The 'expand' debug selector now gives more detail, specifically on the
result of expansion operators and items.
* Bug 2751: Fix include_directory in redirect routers. Previously a
bad comparison between the option value and the name of the file to
be included was done, and a mismatch was wrongly identified.
* Support for Berkeley DB versions 1 and 2 is withdrawn.
* When built with NDBM for hints DB's check for nonexistence of a name
supplied as the db file-pair basename.
* Remove the 'allow_insecure_tainted_data' main config option and the
'taint' log_selector.
* Fix static address-list lookups to properly return the matched item.
Previously only the domain part was returned.
* The ${run} expansion item now expands its command string elements after
splitting. Previously it was before; the new ordering makes handling
zero-length arguments simpler.
* Taint-check exec arguments for transport-initiated external processes.
Previously, tainted values could be used. This affects 'pipe', 'lmtp' and
'queryprogram' transport, transport-filter, and ETRN commands.
The ${run} expansion is also affected: in 'preexpand' mode no part of
the command line may be tainted, in default mode the executable name
may not be tainted.
* Fix CHUNKING on a continued-transport. Previously the usabilility of
the facility was not passed across execs, and only the first message
passed over a connection could use BDAT; any further ones using DATA.
* Support the PIPECONNECT facility in the smtp transport when the helo_data
uses $sending_ip_address and an interface is specified.
* OpenSSL: fix transport-required OCSP stapling verification under session
resumption.
* TLS resumption: the key for session lookup in the client now includes
more info that a server could potentially use in configuring a TLS
session, avoiding oferring mismatching sessions to such a server.
* Fix string_copyn() for limit greater than actual string length.
* Bug 2886: GnuTLS: Do not free the cached creds on transport connection
close; it may be needed for a subsequent connection.
* Fix CHUNKING for a second message on a connection when the first was
rejected.
* Fix ${srs_encode ...} to handle an empty sender address, now returning
an empty address.
* Bug 2855: Handle a v4mapped sender address given us by a frontending
proxy.
update to exim 4.95
* includes taintwarn (taintwarn.patch)
* fast-ramp queue run
* native SRS
* TLS resumption
* LMDB lookups with single key
* smtp transport option 'message_linelength_limit'
* optionally ignore lookup caches
* quota checking for appendfile transport during message reception
* sqlite lookups allow a 'file=<path>' option
* lsearch lookups allow a 'ret=full' option
* command line option for the notifier socket
* faster TLS startup
* new main config option 'proxy_protocol_timeout'
* expand 'smtp_accept_max_per_connection'
* log selector 'queue_size_exclusive'
* main config option 'smtp_backlog_monitor'
* main config option 'hosts_require_helo'
* main config option 'allow_insecure_tainted_data'
Patchnames
openSUSE-2024-7
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for exim",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for exim fixes the following issues:\n\nexim was updated to 4.97.1 (boo#1218387, CVE-2023-51766):\n\n * Fixes for the smtp protocol smuggling (CVE-2023-51766)\n\nexim was updated to exim 4.96:\n\n * Move from using the pcre library to pcre2.\n * Constification work in the filters module required a major version\n bump for the local-scan API. Specifically, the \u0027headers_charset\u0027\n global which is visible via the API is now const and may therefore\n not be modified by local-scan code.\n * Bug 2819: speed up command-line messages being read in. Previously a\n time check was being done for every character; replace that with one\n per buffer.\n * Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string\n sent was prefixed with a length byte.\n * Change the SMTP feature name for pipelining connect to be compliant with\n RFC 5321. Previously Dovecot (at least) would log errors during\n submission.\n * Fix macro-definition during \u0027-be\u0027 expansion testing. The move to\n write-protected store for macros had not accounted for these runtime\n additions; fix by removing this protection for \u0027-be\u0027 mode.\n * Convert all uses of select() to poll().\n * Fix use of $sender_host_name in daemon process. When used in certain\n main-section options or in a connect ACL, the value from the first ever\n connection was never replaced for subsequent connections.\n * Bug 2838: Fix for i32lp64 hard-align platforms\n * Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value\n with underbars is given.\n * Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters.\n * Debugging initiated by an ACL control now continues through into routing\n and transport processes.\n * The \u0027expand\u0027 debug selector now gives more detail, specifically on the\n result of expansion operators and items.\n * Bug 2751: Fix include_directory in redirect routers. Previously a\n bad comparison between the option value and the name of the file to\n be included was done, and a mismatch was wrongly identified.\n * Support for Berkeley DB versions 1 and 2 is withdrawn.\n * When built with NDBM for hints DB\u0027s check for nonexistence of a name\n supplied as the db file-pair basename.\n * Remove the \u0027allow_insecure_tainted_data\u0027 main config option and the\n \u0027taint\u0027 log_selector.\n * Fix static address-list lookups to properly return the matched item.\n Previously only the domain part was returned.\n * The ${run} expansion item now expands its command string elements after\n splitting. Previously it was before; the new ordering makes handling\n zero-length arguments simpler.\n * Taint-check exec arguments for transport-initiated external processes.\n Previously, tainted values could be used. This affects \u0027pipe\u0027, \u0027lmtp\u0027 and\n \u0027queryprogram\u0027 transport, transport-filter, and ETRN commands.\n The ${run} expansion is also affected: in \u0027preexpand\u0027 mode no part of\n the command line may be tainted, in default mode the executable name\n may not be tainted.\n * Fix CHUNKING on a continued-transport. Previously the usabilility of\n the facility was not passed across execs, and only the first message\n passed over a connection could use BDAT; any further ones using DATA.\n * Support the PIPECONNECT facility in the smtp transport when the helo_data\n uses $sending_ip_address and an interface is specified.\n * OpenSSL: fix transport-required OCSP stapling verification under session\n resumption.\n * TLS resumption: the key for session lookup in the client now includes\n more info that a server could potentially use in configuring a TLS\n session, avoiding oferring mismatching sessions to such a server.\n * Fix string_copyn() for limit greater than actual string length.\n * Bug 2886: GnuTLS: Do not free the cached creds on transport connection\n close; it may be needed for a subsequent connection.\n * Fix CHUNKING for a second message on a connection when the first was\n rejected.\n * Fix ${srs_encode ...} to handle an empty sender address, now returning\n an empty address.\n * Bug 2855: Handle a v4mapped sender address given us by a frontending\n proxy.\n\nupdate to exim 4.95\n\n * includes taintwarn (taintwarn.patch)\n * fast-ramp queue run\n * native SRS\n * TLS resumption\n * LMDB lookups with single key\n * smtp transport option \u0027message_linelength_limit\u0027\n * optionally ignore lookup caches\n * quota checking for appendfile transport during message reception\n * sqlite lookups allow a \u0027file=\u003cpath\u003e\u0027 option\n * lsearch lookups allow a \u0027ret=full\u0027 option\n * command line option for the notifier socket\n * faster TLS startup\n * new main config option \u0027proxy_protocol_timeout\u0027\n * expand \u0027smtp_accept_max_per_connection\u0027\n * log selector \u0027queue_size_exclusive\u0027\n * main config option \u0027smtp_backlog_monitor\u0027\n * main config option \u0027hosts_require_helo\u0027\n * main config option \u0027allow_insecure_tainted_data\u0027",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2024-7",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_0007-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2024:0007-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HHLYW3QLWRHGQXVXSQUL2DBTCFFCJGNB/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2024:0007-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HHLYW3QLWRHGQXVXSQUL2DBTCFFCJGNB/"
},
{
"category": "self",
"summary": "SUSE Bug 1218387",
"url": "https://bugzilla.suse.com/1218387"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-3559 page",
"url": "https://www.suse.com/security/cve/CVE-2022-3559/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-42114 page",
"url": "https://www.suse.com/security/cve/CVE-2023-42114/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-42115 page",
"url": "https://www.suse.com/security/cve/CVE-2023-42115/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-42116 page",
"url": "https://www.suse.com/security/cve/CVE-2023-42116/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-42117 page",
"url": "https://www.suse.com/security/cve/CVE-2023-42117/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-42119 page",
"url": "https://www.suse.com/security/cve/CVE-2023-42119/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-51766 page",
"url": "https://www.suse.com/security/cve/CVE-2023-51766/"
}
],
"title": "Security update for exim",
"tracking": {
"current_release_date": "2024-01-03T20:12:49Z",
"generator": {
"date": "2024-01-03T20:12:49Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:0007-1",
"initial_release_date": "2024-01-03T20:12:49Z",
"revision_history": [
{
"date": "2024-01-03T20:12:49Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-bp155.5.9.1.aarch64",
"product": {
"name": "exim-4.97.1-bp155.5.9.1.aarch64",
"product_id": "exim-4.97.1-bp155.5.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-bp155.5.9.1.aarch64",
"product": {
"name": "eximon-4.97.1-bp155.5.9.1.aarch64",
"product_id": "eximon-4.97.1-bp155.5.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"product": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"product_id": "eximstats-html-4.97.1-bp155.5.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-bp155.5.9.1.ppc64le",
"product": {
"name": "exim-4.97.1-bp155.5.9.1.ppc64le",
"product_id": "exim-4.97.1-bp155.5.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-bp155.5.9.1.ppc64le",
"product": {
"name": "eximon-4.97.1-bp155.5.9.1.ppc64le",
"product_id": "eximon-4.97.1-bp155.5.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"product": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"product_id": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-bp155.5.9.1.s390x",
"product": {
"name": "exim-4.97.1-bp155.5.9.1.s390x",
"product_id": "exim-4.97.1-bp155.5.9.1.s390x"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-bp155.5.9.1.s390x",
"product": {
"name": "eximon-4.97.1-bp155.5.9.1.s390x",
"product_id": "eximon-4.97.1-bp155.5.9.1.s390x"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-bp155.5.9.1.s390x",
"product": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.s390x",
"product_id": "eximstats-html-4.97.1-bp155.5.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "exim-4.97.1-bp155.5.9.1.x86_64",
"product": {
"name": "exim-4.97.1-bp155.5.9.1.x86_64",
"product_id": "exim-4.97.1-bp155.5.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "eximon-4.97.1-bp155.5.9.1.x86_64",
"product": {
"name": "eximon-4.97.1-bp155.5.9.1.x86_64",
"product_id": "eximon-4.97.1-bp155.5.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"product": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"product_id": "eximstats-html-4.97.1-bp155.5.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP5",
"product": {
"name": "SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5"
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.5",
"product": {
"name": "openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.aarch64 as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.ppc64le as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.s390x as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.x86_64 as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.aarch64 as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.ppc64le as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.s390x as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.x86_64 as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.aarch64 as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.s390x as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.x86_64 as component of SUSE Package Hub 15 SP5",
"product_id": "SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.aarch64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.ppc64le as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.s390x as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "exim-4.97.1-bp155.5.9.1.x86_64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64"
},
"product_reference": "exim-4.97.1-bp155.5.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.aarch64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.ppc64le as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.s390x as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximon-4.97.1-bp155.5.9.1.x86_64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64"
},
"product_reference": "eximon-4.97.1-bp155.5.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.aarch64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.s390x as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "eximstats-html-4.97.1-bp155.5.9.1.x86_64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
},
"product_reference": "eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-3559",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-3559"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-3559",
"url": "https://www.suse.com/security/cve/CVE-2022-3559"
},
{
"category": "external",
"summary": "SUSE Bug 1204427 for CVE-2022-3559",
"url": "https://bugzilla.suse.com/1204427"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "important"
}
],
"title": "CVE-2022-3559"
},
{
"cve": "CVE-2023-42114",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-42114"
}
],
"notes": [
{
"category": "general",
"text": "Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to disclose information in the context of the service account.\n. Was ZDI-CAN-17433.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-42114",
"url": "https://www.suse.com/security/cve/CVE-2023-42114"
},
{
"category": "external",
"summary": "SUSE Bug 1215784 for CVE-2023-42114",
"url": "https://bugzilla.suse.com/1215784"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "moderate"
}
],
"title": "CVE-2023-42114"
},
{
"cve": "CVE-2023-42115",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-42115"
}
],
"notes": [
{
"category": "general",
"text": "Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-17434.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-42115",
"url": "https://www.suse.com/security/cve/CVE-2023-42115"
},
{
"category": "external",
"summary": "SUSE Bug 1215785 for CVE-2023-42115",
"url": "https://bugzilla.suse.com/1215785"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "important"
}
],
"title": "CVE-2023-42115"
},
{
"cve": "CVE-2023-42116",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-42116"
}
],
"notes": [
{
"category": "general",
"text": "Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-17515.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-42116",
"url": "https://www.suse.com/security/cve/CVE-2023-42116"
},
{
"category": "external",
"summary": "SUSE Bug 1215786 for CVE-2023-42116",
"url": "https://bugzilla.suse.com/1215786"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "critical"
}
],
"title": "CVE-2023-42116"
},
{
"cve": "CVE-2023-42117",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-42117"
}
],
"notes": [
{
"category": "general",
"text": "Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17554.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-42117",
"url": "https://www.suse.com/security/cve/CVE-2023-42117"
},
{
"category": "external",
"summary": "SUSE Bug 1215787 for CVE-2023-42117",
"url": "https://bugzilla.suse.com/1215787"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "critical"
}
],
"title": "CVE-2023-42117"
},
{
"cve": "CVE-2023-42119",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-42119"
}
],
"notes": [
{
"category": "general",
"text": "Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account.\n. Was ZDI-CAN-17643.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-42119",
"url": "https://www.suse.com/security/cve/CVE-2023-42119"
},
{
"category": "external",
"summary": "SUSE Bug 1215789 for CVE-2023-42119",
"url": "https://bugzilla.suse.com/1215789"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "low"
}
],
"title": "CVE-2023-42119"
},
{
"cve": "CVE-2023-51766",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-51766"
}
],
"notes": [
{
"category": "general",
"text": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports \u003cLF\u003e.\u003cCR\u003e\u003cLF\u003e but some other popular e-mail servers do not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-51766",
"url": "https://www.suse.com/security/cve/CVE-2023-51766"
},
{
"category": "external",
"summary": "SUSE Bug 1218387 for CVE-2023-51766",
"url": "https://bugzilla.suse.com/1218387"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:exim-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximon-4.97.1-bp155.5.9.1.x86_64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"SUSE Package Hub 15 SP5:eximstats-html-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:exim-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximon-4.97.1-bp155.5.9.1.x86_64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.aarch64",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.ppc64le",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.s390x",
"openSUSE Leap 15.5:eximstats-html-4.97.1-bp155.5.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-01-03T20:12:49Z",
"details": "moderate"
}
],
"title": "CVE-2023-51766"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…