medium5.4
CVE-2024-34083
aiosmtpd STARTTLS unencrypted commands injection
Impact
### Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack. ### References * [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | aiosmtpd | < 1.4.6 | 1.4.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda
- https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8
- https://nostarttls.secvuln.info
- https://github.com/advisories/GHSA-wgjv-9j3q-jhg8
- https://nvd.nist.gov/vuln/detail/CVE-2024-34083