Re: Re: New SMTP smuggling attack

[Marcus Meissner <meissner () suse de>]

On Sat, Dec 23, 2023 at 02:29:34PM +0200, Valtteri Vuorikoski wrote:
> On Fri, Dec 22, 2023 at 11:46:48AM +0100, Marcus Meissner wrote:
> > Hi,
> >
> > FWIW as no CVEs were to be found yet, I filed a CVE request for Postfix now.
> >
> > Not sure if we need it for others like sendmail too, as that is also
> > referenced by the security researchers.
>
> Looks like exim opened a bug on this yesterday too, no sign of CVE yet:
> <https://bugs.exim.org/show_bug.cgi?id=3063>

CVEs are assigned now for:

- CVE-2023-51764 postfix
- CVE-2023-51765 sendmail
- CVE-2023-51766 exim

Ciao, Marcus