p PatchFirst

CVE-2024-34083

CVE-2024-34083 · STARTTLS unencrypted commands injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

CVSS 5.4 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • aiosmtpd

    Versions
    • < 1.4.6: Affected

    No fix published

  • python-aiosmtpd Debian:12

    Versions
    • 1.4.3-1.1
    Affected ranges
    • ECOSYSTEM: < 1.4.3-1.1+deb12u1

    Update to 1.4.3-1.1+deb12u1

  • python-aiosmtpd Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.4.6-1

    Update to 1.4.6-1

  • python-aiosmtpd Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.4.6-1

    Update to 1.4.6-1

  • aiosmtpd PyPI

    Versions
    • 1.0
    • 1.0a1
    • 1.0a2
    • 1.0a3
    • 1.0a4
    • 1.0a5
    • 1.0b1
    • 1.0rc1
    • 1.1
    • 1.2
    • 1.2.2
    • 1.2.4
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.3rc1
    • 1.4.3rc2
    • 1.4.4
    • 1.4.4.post1
    • 1.4.4.post2
    • 1.4.5
    Affected ranges
    • ECOSYSTEM: < 1.4.6

    Update to 1.4.6

  • python-aiosmtpd Ubuntu:18.04:LTS

    Versions
    • 1.1-3
    • 1.1-4
    • 1.1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-aiosmtpd Ubuntu:20.04:LTS

    Versions
    • 1.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-aiosmtpd Ubuntu:22.04:LTS

    Versions
    • 1.2.2-1
    • 1.4.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-aiosmtpd Ubuntu:24.04:LTS

    Versions
    • 1.4.3-1.1
    • 1.4.4.post2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-aiosmtpd Ubuntu:25.10

    Versions
    • 1.4.6-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-aiosmtpd Ubuntu:26.10

    Versions
    • 1.4.6-6
    • 1.4.6-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-aiosmtpd Ubuntu:26.04:LTS

    Versions
    • 1.4.6-5
    • 1.4.6-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →