Medium severity · published May 18, 2024
CVE-2024-34083
STARTTLS unencrypted commands injection
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
aiosmtpd · aio-libs
< 1.4.6 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34083
github.com
https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda
github.com
https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8
nostarttls.secvuln.info
https://nostarttls.secvuln.info
More from aiosmtpd
5.3
CVE-2024-27305
SMTP smuggling in aiosmtpd