SUSE-SU-2024:0012-1

MEDIUM5.3

Security update for postfix

Published Jan 2, 2024

Modified 2 years ago

Fix available

Details

Description of the patch:

This update for postfix fixes the following issues:

CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

Affected Packages

postfix

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

3.5.9-150300.5.15.1

postfix-bdb

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

Fixed in:

3.5.9-150300.5.15.1

postfix-bdb-lmdb

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

Fixed in:

3.5.9-150300.5.15.1

postfix-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

3.5.9-150300.5.15.1

postfix-doc

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

3.5.9-150300.5.15.1

postfix-ldap

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

3.5.9-150300.5.15.1

postfix-mysql

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

Fixed in:

3.5.9-150300.5.15.1

postfix-postgresql

openSUSE Leap 15.4

Fixed in:

3.5.9-150300.5.15.1

References

https://bugzilla.suse.com/1218304

https://bugzilla.suse.com/1218314

https://lists.suse.com/pipermail/sle-security-updates/2024-January/017584.html

https://www.suse.com/security/cve/CVE-2023-51764/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20240012-1/

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

5.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Upstream

Ecosystems(22)

SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Timeline

PublishedJan 2, 2024

ModifiedJan 2, 2024

SUSE-SU-2024:0012-1 | Mondoo Vulnerability Intelligence