aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to     inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation     differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails     with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP     software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to     inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2024-27305)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to
    inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation
    differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails
    with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP
    software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to
    inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to
    upgrade. There are no known workarounds for this vulnerability. (CVE-2024-27305)

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0243-1 advisory.

    - CVE-2024-34083: Fixed MiTM attack could inject extra unencrypted commands after STARTTLS (boo#1224467)
    - CVE-2024-27305: Fixed SMTP smuggling (boo#1221328)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
258451	Linux Distros Unpatched Vulnerability : CVE-2024-27305	Nessus	Misc.	Local	medium
417675	SCA: security update for aiosmtpd (GHSA-pr2m-px7j-xg65)	Tenable Cloud Security	SCA Checks	Local	medium
417675	SCA: security update for aiosmtpd (GHSA-pr2m-px7j-xg65)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
205751	openSUSE 15 Security Update : python-aiosmtpd (openSUSE-SU-2024:0243-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-27305

medium

Tenable Plugins

medium

medium

medium

medium