GitHub Advisoryadvisory · PyPI
GHSA-wgjv-9j3q-jhg8 aiosmtpd STARTTLS unencrypted commands injection
MEDIUM
Official page ↗
- Aliases
- CVE-2024-34083
- Ecosystem
- PyPI
- Packages
- aiosmtpd
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-349
- Reviewed
- 2024-05-20
Affected packages
• PyPI aiosmtpd: < 1.4.6 → fixed in 1.4.6
Description
Summary
Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.
References
• NO STARTTLS: Similar vulnerabilities discovered by previous researchers.
Related
Alias · CVE (1)
- CVE-2024-34083 aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. vulnerability
Weakness · CWE (1)
- CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data weakness
References
- https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-34083 advisory
- https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda web
- https://github.com/aio-libs/aiosmtpd package
- https://nostarttls.secvuln.info web