CVE-2024-34083

Published: May 18, 2024Modified: Jun 17, 2026Deferred

5.4

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

Related CWEs

Acceptance of Extraneous Untrusted Data With Trusted Data

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

References (6)

https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda

Source: security-advisories@github.com

https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8

Source: security-advisories@github.com

https://nostarttls.secvuln.info

Source: security-advisories@github.com

https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8

Source: af854a3a-2127-422b-91ae-364da2661108

https://nostarttls.secvuln.info

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.