CVE-2023-51765: freebsd

Vulnerability summary

CVE-2023-51765 is a medium (CVSS 5.3) vulnerability in freebsd. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-12-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.

• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.