CVE-2024-27938

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-27938
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27938.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-27938
Aliases
  • GHSA-j42r-6c99-hqf2
Published
2024-03-11T21:18:14.988Z
Modified
2025-11-30T18:42:03.265851Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
SMTP Smuggling in Postal
Details

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has 'authorised' to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with <CR><LF> line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly <CR><LF>.<CR><LF>. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-116"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27938.json"
}
References

Affected packages

Git / github.com/postalserver/postal

Affected ranges

Type
GIT
Repo
https://github.com/postalserver/postal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
78cb326d616981ffc346f4074b0dd98ffa89a317

Affected versions

2.*

2.0.0
2.0.0-beta.1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27938.json"