Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6591.2
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6591-2)
Summary:	The remote host is missing an update for the 'postfix' package(s) announced via the USN-6591-2 advisory.
Description:	Summary: The remote host is missing an update for the 'postfix' package(s) announced via the USN-6591-2 advisory. Vulnerability Insight: USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of regression has been made available since the last update. This update updates the fix and aligns with the latest configuration guidelines regarding this vulnerability. We apologize for the inconvenience. Original advisory details: Timo Longin discovered that Postfix incorrectly handled certain email line endings. A remote attacker could possibly use this issue to bypass an email authentication mechanism, allowing domain spoofing and potential spamming. Please note that certain configuration changes are required to address this issue. They are not enabled by default for backward compatibility. Information can be found at [link moved to references]. Affected Software/OS: 'postfix' package(s) on Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 23.10. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-51764 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/ https://access.redhat.com/security/cve/CVE-2023-51764 https://bugzilla.redhat.com/show_bug.cgi?id=2255563 https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html https://github.com/duy-31/CVE-2023-51764 https://github.com/eeenvik1/CVE-2023-51764 https://lwn.net/Articles/956533/ https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ https://www.openwall.com/lists/oss-security/2024/01/22/1 https://www.postfix.org/announcements/postfix-3.8.5.html https://www.postfix.org/smtp-smuggling.html https://www.youtube.com/watch?v=V8KPV96g1To https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html http://www.openwall.com/lists/oss-security/2023/12/24/1 http://www.openwall.com/lists/oss-security/2023/12/25/1 http://www.openwall.com/lists/oss-security/2024/05/09/3
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.