It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-495 advisory.

    Postfix through 3.8.4 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13,     3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3725 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3725-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     January 30, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : postfix     Version        : 3.4.23-0+deb10u2     CVE ID         : CVE-2023-51764     Debian Bug     : 1059230

    Postfix, a popular mail server,     allowed SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining     and smtpd_discard_ehlo_keywords=chunking     (or certain other options that exist in recent versions).

    Remote attackers can use a published exploitation technique to     inject e-mail messages with a spoofed MAIL FROM address,     allowing bypass of an SPF protection mechanism.

    This occurs because Postfix supported <LF>.<CR><LF> but     some other popular e-mail servers do not.

    To prevent attack variants (by always disallowing <LF> without <CR>),     a different solution is required, such as setting the backported     configuration option smtpd_forbid_bare_newline=yes

    For Debian 10 buster, this problem has been fixed in version     3.4.23-0+deb10u2.

    We recommend that you upgrade your postfix packages.

    For the detailed security status of postfix please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/postfix

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6591-2 advisory.

    USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of regression has been made available     since the last update. This update updates the fix and aligns with the latest configuration guidelines     regarding this vulnerability.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1149-1 advisory.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Postfix through 3.8.5 allows SMTP smuggling unless configured with     smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain     other options that exist in recent versions). Remote attackers can use a published exploitation technique     to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection     mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do     not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is     required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23,     3.6.13, 3.7.9, 3.8.4, or 3.9. (CVE-2023-51764)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9243 advisory.

    [2:3.5.25-1]
    - New version       Resolves: RHEL-20023
    - Dropped upstreamed patches

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9252:01 advisory.

    * postfix: SMTP smuggling vulnerability (CVE-2023-51764)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
189351	Amazon Linux 2023 : postfix, postfix-cdb, postfix-ldap (ALAS2023-2024-495)	Nessus	Amazon Linux Local Security Checks	2024/1/23	2024/12/11	medium
189772	Debian dla-3725 : postfix - security update	Nessus	Debian Local Security Checks	2024/1/30	2025/1/22	medium
189851	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.10 : Postfix update (USN-6591-2)	Nessus	Ubuntu Local Security Checks	2024/1/31	2024/10/29	medium
193042	SUSE SLES12 Security Update : postfix (SUSE-SU-2024:1149-1)	Nessus	SuSE Local Security Checks	2024/4/9	2024/4/9	medium
226366	Linux Distros Unpatched Vulnerability : CVE-2023-51764	Nessus	Misc.	2025/3/5	2025/9/4	medium
211560	Oracle Linux 9 : post (ELSA-2024-9243)	Nessus	Oracle Linux Local Security Checks	2024/11/19	2025/9/11	medium
292115	MiracleLinux 9 : postfix-3.5.25-1.el9 (AXSA:2024-9252:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium