CVE-2023-51765 json
sendmail through 8.17.2 allows SMTP smuggling in certain configurations.
published 2023-12-24 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-56454
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 65%
- public exploits
- 0
- none known
Summary
sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
Patch / fix
- sendmail sendmail 8.18.0.2
- freebsd freebsd 11.0
- sendmail Debian 12 8.17.1.9-2+deb12u1
- sendmail Debian 14, Debian 13 8.18.1-1
debian advisories DEBIAN-CVE-2023-51765
- sendmail SLE Module for Package Hub 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 8.15.2-150000.8.12.1
- sendmail SLE Module for Legacy 12 8.14.9-4.9.1
suse advisories SUSE-SU-2024:0743-1SUSE-SU-2024:0742-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-51765 updated cvss 5.3
sendmail: SMTP smuggling vulnerability
-
Red Hat Enterprise Linux 6 sendmail, sendmail-cf, sendmail-milter Red Hat Enterprise Linux 7 sendmail, sendmail-cf, sendmail-milter, sendmail-sysvinitaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 sendmail, sendmail-cf, sendmail-milter Red Hat Enterprise Linux 9 sendmail, sendmail-cf, sendmail-milteraffected: workaround, no fix planned “Will not fix”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- youtube.com https://www.youtube.com/watch?v=V8KPV96g1To referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Classification
- Weakness
-
- CWE-345 Insufficient Verification of Data Authenticity
References
-
github.com
/freebsd/freebsd-src/commit/5dd76dd0cc19450133aa379ce0ce4a68ae07fb39#diff-afdf514b32ac88004952c11660c57bc96c3d
patch
-
bugzilla.suse.com
/show_bug.cgi?id=1218351
issue-tracking, patch, third-party-advisory
-
youtube.com
/watch?v=V8KPV96g1To
exploit
-
sec-consult.com
/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
technical-description, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/22/7
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/21/7
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/24/1
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/25/1
mailing-list, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2255869
issue-tracking, third-party-advisory
-
access.redhat.com
/security/cve/CVE-2023-51765
third-party-advisory
-
fahrplan.events.ccc.de
/congress/2023/fahrplan/events/11782.html
technical-description
-
openwall.com
/lists/oss-security/2023/12/26/5
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/29/5
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/30/3
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2023/12/30/1
mailing-list, third-party-advisory
- lwn.net /Articles/956533/
-
lists.debian.org
/debian-lts-announce/2024/06/msg00004.html
mailing-list
Sources
- CVE List CVE-2023-51765
- NVD CVE-2023-51765
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.