Workflow

PyPi: Aiosmtpd

CVE-2024-34083

Safety vulnerability ID: 71242

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at May 18, 2024 Updated at Nov 29, 2024
Scan your Python projects for vulnerabilities →

Advisory

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue. See CVE-2024-34083.

Affected package

aiosmtpd

Latest version: 1.4.6

aiosmtpd - asyncio based SMTP server

Affected versions

Fixed versions

Vulnerability changelog

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue. See CVE-2024-34083.


MISC:https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda: https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda
MISC:https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8: https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8
MISC:https://nostarttls.secvuln.info: https://nostarttls.secvuln.info

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application