Skip to content
Fencer Vulns
medium 5.3

CVE-2023-51764 json

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_…

published 2023-12-24 2 y ago modified 2026-10-08 31 d ago also EUVD-2023-56453

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

Patch / fix

  • postfix postfix 3.5.23, 3.6.13, 3.7.9, 3.8.4
  • postfix Debian 12 3.7.9-0+deb12u1
  • postfix Debian 14, Debian 13 3.8.4-1

debian advisories DEBIAN-CVE-2023-51764

  • postfix Ubuntu 20.04 LTS 3.4.13-0ubuntu1.4
  • postfix Ubuntu 22.04 LTS 3.6.4-1ubuntu1.3
  • postfix Ubuntu Pro 14.04 LTS 2.11.0-1ubuntu1.2+esm3
  • postfix Ubuntu Pro 16.04 LTS 3.1.0-3ubuntu0.4+esm3
  • postfix Ubuntu Pro 18.04 LTS 3.3.0-1ubuntu0.4+esm3

ubuntu advisories UBUNTU-CVE-2023-51764

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • postfix RHEL 9 2:3.5.25-1.el9
  • postfix-cdb RHEL 9 2:3.5.25-1.el9
  • postfix-ldap RHEL 9 2:3.5.25-1.el9
  • postfix-lmdb RHEL 9 2:3.5.25-1.el9
  • postfix-pcre RHEL 9 2:3.5.25-1.el9
  • postfix-mysql RHEL 9 2:3.5.25-1.el9
  • postfix-pgsql RHEL 9 2:3.5.25-1.el9
  • postfix-sqlite RHEL 9 2:3.5.25-1.el9

red hat advisories RHSA-2024:9243

  • postfix SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 3.2.10-3.30.1
  • postfix SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +12 more 3.5.9-150300.5.15.1
  • postfix-bdb SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +8 more 3.5.9-150300.5.15.1
  • postfix SLE Module for Server Applications 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 3.7.3-150500.3.11.1
  • postfix-bdb SLE Module for Legacy 15 SP5, openSUSE Leap 15.5 3.7.3-150500.3.11.1

suse advisories SUSE-SU-2024:1149-1SUSE-SU-2024:0012-1SUSE-SU-2023:4981-1

  • postfix openSUSE Tumbleweed 3.8.4-2.1

opensuse advisories openSUSE-SU-2024:13538-1

  • postfix AlmaLinux 9 2:3.5.25-1.el9
  • postfix-cdb AlmaLinux 9 2:3.5.25-1.el9
  • postfix-ldap AlmaLinux 9 2:3.5.25-1.el9
  • postfix-lmdb AlmaLinux 9 2:3.5.25-1.el9
  • postfix-pcre AlmaLinux 9 2:3.5.25-1.el9
  • postfix-mysql AlmaLinux 9 2:3.5.25-1.el9
  • postfix-pgsql AlmaLinux 9 2:3.5.25-1.el9
  • postfix-sqlite AlmaLinux 9 2:3.5.25-1.el9

almalinux advisories ALSA-2024:9243

  • postfix Rocky Linux 9 2:3.5.25-1.el9

rocky linux advisories RLSA-2024:9243

  • postfix CBL-Mariner 2.0 3.7.0-3
  • postfix Azure Linux 3.0 3.9.0-1

azure linux advisories AZL-32296AZL-35110

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-51764 updated cvss 5.3

postfix: SMTP smuggling vulnerability

  • Red Hat Enterprise Linux 6 postfix, postfix-perl-scripts Red Hat Enterprise Linux 7 postfix, postfix-sysvinit, postfix-perl-scripts
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 postfix, postfix-cdb, postfix-ldap, postfix-pcre, postfix-mysql, postfix-pgsql, +2 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 9) postfix 3.5.25-1.el9, postfix-cdb 3.5.25-1.el9, postfix-ldap 3.5.25-1.el9, postfix-lmdb 3.5.25-1.el9, postfix-pcre 3.5.25-1.el9, postfix-mysql 3.5.25-1.el9, +3 more
    fixed: vendor fix RHSA-2024:9243

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • postfix.org https://www.postfix.org/smtp-smuggling.html referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/eeenvik1/CVE-2023-51764 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/duy-31/CVE-2023-51764 referenced PoC, tagged "exploit" by a source, unverified
  • youtube.com https://www.youtube.com/watch?v=V8KPV96g1To referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.