// For flags

CVE-2024-34083

STARTTLS unencrypted commands injection

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

aiosmptd es una reimplementación de Python stdlib smtpd.py basada en asyncio. Antes de la versión 1.4.6, los servidores basados en aiosmtpd aceptaban comandos adicionales no cifrados después de STARTTLS, tratándolos como si provinieran del interior de la conexión cifrada. Esto podría aprovecharse mediante un man in the middle. La versión 1.4.6 contiene un parche para el problema.

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-30 CVE Reserved
  • 2024-05-18 CVE Published
  • 2024-05-19 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Aio-libs
Search vendor "Aio-libs"
 Aiosmtpd
Search vendor "Aio-libs" for product "Aiosmtpd"
 < 1.4.6
Search vendor "Aio-libs" for product "Aiosmtpd" and version " < 1.4.6"
en
Affected