← Zuruck zu CVEs

CVE-2024-34083

MEDIUM

5.4

Beschreibung

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

CVE Details

CVSS v3.1 Bewertung5.4

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AngriffsvektorADJACENT_NETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht5/18/2024

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-349

Referenzen

https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda(security-advisories@github.com)

https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8(security-advisories@github.com)

https://nostarttls.secvuln.info(security-advisories@github.com)

https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8(af854a3a-2127-422b-91ae-364da2661108)

https://nostarttls.secvuln.info(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.