CVE-2023-51764

A flaw was found in some SMTP server configurations in Postfix. This flaw allows a remote attacker to break out email message data to "smuggle" SMTP commands and send spoofed emails that pass SPF checks.

Out of the box, Postfix targets to accommodate older clients with faulty SMTP implementations due to which restrictions are not enforced in the default configuration. Appropriate mitigation strategies are mentioned in the appropriate section below.

The impact is considered Moderate likely due to certain conditions required for successful exploitation, such as specific server configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can be PARTIALLY mitigated via the following options in the main.cf:

smtpd_data_restrictions = reject_unauth_pipelining smtpd_discard_ehlo_keywords = chunking, silent-discard

Please note this only blocks the misuse of SMTP command pipelining, but does not address message pipelining nor malformed line endings. The only fix for these issues are via package updates.