onyx --cves cve-2023-51766
CVE-2023-51766
- score
- <0.1
- cvss
- 5.3
- epss
- 1.1%
- published
- 2023-12-24
- kev added
- —
- first seen
Exim before 4.97.1 contains an SMTP smuggling vulnerability caused by support for <LF>.<CR><LF> in certain PIPELINING/CHUNKING configurations, letting remote attackers inject spoofed email messages, exploit requires specific SMTP configuration.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766
Exploit availability
Weaknesses
References 21
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- https://www.youtube.com/watch?v=V8KPV96g1To
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/
- https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca
- https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766
- http://www.openwall.com/lists/oss-security/2023/12/24/1
- http://www.openwall.com/lists/oss-security/2024/01/01/3
- https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/
- https://bugs.exim.org/show_bug.cgi?id=3063
- http://www.openwall.com/lists/oss-security/2023/12/25/1
- http://www.openwall.com/lists/oss-security/2023/12/29/2
- https://bugzilla.redhat.com/show_bug.cgi?id=2255852
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://www.openwall.com/lists/oss-security/2023/12/23/2
- https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5
- http://www.openwall.com/lists/oss-security/2024/01/01/1
- http://www.openwall.com/lists/oss-security/2024/01/01/2
- https://lwn.net/Articles/956533/