Skip to content

Product

debian/python-aiosmtpd vulnerabilities

2 published CVES affecting debian/python-aiosmtpd, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest debian/python-aiosmtpd CVEs

Newest publication first

  1. CVE-2024-34083 aiosmtpd STARTTLS unencrypted commands injection

    MediumCVSS 5.4

    Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack. References NO STARTTLS: Similar vulnerabilities discovered by previous researchers.

  2. CVE-2024-27305 aiosmtpd vulnerable to SMTP smuggling

    MediumCVSS 5.3

    Summary aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.