SMTP Smuggling
CVE / CVSS
| CVE | CVSS | EPSS | Vector | Source |
|---|---|---|---|---|
| CVE-2023-51764 (opens in a new tab) Debian (opens in a new tab) | CVSS 5.3 Medium | 2.6 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD (v3.1) |
Base scores are looked up from NVD or, if NVD has none yet, the CVE record. Proxmox itself does not publish CVSS scores. “Actively exploited” comes from the CISA KEV catalog, EPSS (probability of exploitation in the next 30 days) from FIRST.
Affected packages
pmg-api, postfix
Details
Postfix was affected by an email spoofing attack that involves a composition of email services with specific differences in the way they handle line endings other than <CR><LF>. See references below for timeline, mitigations and details.
Fixed in
- pmg-api >= 8.0.10 (Proxmox Mail Gateway 8.x)
- pmg-api >= 7.3-11 (Proxmox Mail Gateway 7.x)
References
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.