id: PYSEC-2024-221
modified: 2025-01-22T16:23:18.042465Z
published: 2024-03-12T21:15:58Z
aliases:
- CVE-2024-27305
- GHSA-pr2m-px7j-xg65
details: aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio.
  aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability
  based on not so novel interpretation differences of the SMTP protocol. By exploiting
  SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses,
  allowing advanced phishing attacks. This issue is also existed in other SMTP software
  like Postfix. With the right SMTP server constellation, an attacker can send spoofed
  e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in
  version 1.4.5. Users are advised to upgrade. There are no known workarounds for
  this vulnerability.
affected:
- package:
    ecosystem: PyPI
    name: aiosmtpd
    purl: pkg:pypi/aiosmtpd
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 24b6c79c8921cf1800e27ca144f4f37023982bbb
    repo: https://github.com/aio-libs/aiosmtpd
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.4.5
  versions:
  - "1.0"
  - 1.0a1
  - 1.0a2
  - 1.0a3
  - 1.0a4
  - 1.0a5
  - 1.0b1
  - 1.0rc1
  - "1.1"
  - "1.2"
  - 1.2.2
  - 1.2.4
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.4.0
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.4.3rc1
  - 1.4.3rc2
  - 1.4.4
  - 1.4.4.post1
  - 1.4.4.post2
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
references:
- type: ADVISORY
  url: https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65
- type: FIX
  url: 
    https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb
- type: WEB
  url: https://www.postfix.org/smtp-smuggling.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-pr2m-px7j-xg65