{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu20.04els/vex/2023/cve-2023-51766-els_os-ubuntu20_04els.json" } ], "tracking": { "current_release_date": "2026-06-13T14:16:56Z", "generator": { "date": "2026-06-17T00:25:16Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2023-51766-ELS_OS-UBUNTU20.04ELS", "initial_release_date": "2023-12-24T06:15:00Z", "revision_history": [ { "date": "2023-12-24T06:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-06-13T14:16:56Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2023-51766" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "eximon4-0:4.93-13ubuntu1.12.amd64", "product": { "name": "eximon4-0:4.93-13ubuntu1.12.amd64", "product_id": "eximon4-0:4.93-13ubuntu1.12.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/eximon4@4.93-13ubuntu1.12?arch=amd64" } } }, { "category": "product_version", "name": "exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "product": { "name": "exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "product_id": "exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/exim4-daemon-light@4.93-13ubuntu1.12?arch=amd64" } } }, { "category": "product_version", "name": "exim4-dev-0:4.93-13ubuntu1.12.amd64", "product": { "name": "exim4-dev-0:4.93-13ubuntu1.12.amd64", "product_id": "exim4-dev-0:4.93-13ubuntu1.12.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/exim4-dev@4.93-13ubuntu1.12?arch=amd64" } } }, { "category": "product_version", "name": "exim4-base-0:4.93-13ubuntu1.12.amd64", "product": { "name": "exim4-base-0:4.93-13ubuntu1.12.amd64", "product_id": "exim4-base-0:4.93-13ubuntu1.12.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/exim4-base@4.93-13ubuntu1.12?arch=amd64" } } }, { "category": "product_version", "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "product": { "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "product_id": "exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/exim4-daemon-heavy@4.93-13ubuntu1.12?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "exim4-config-0:4.93-13ubuntu1.12.all", "product": { "name": "exim4-config-0:4.93-13ubuntu1.12.all", "product_id": "exim4-config-0:4.93-13ubuntu1.12.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/exim4-config@4.93-13ubuntu1.12?arch=all" } } }, { "category": "product_version", "name": "exim4-0:4.93-13ubuntu1.12.all", "product": { "name": "exim4-0:4.93-13ubuntu1.12.all", "product_id": "exim4-0:4.93-13ubuntu1.12.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/exim4@4.93-13ubuntu1.12?arch=all" } } } ], "category": "architecture", "name": "all" }, { "branches": [ { "category": "product_name", "name": "Ubuntu 20.04", "product": { "name": "Ubuntu 20.04", "product_id": "Ubuntu-20", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product": { "name": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_id": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/eximon4@4.93-13ubuntu1.12%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product": { "name": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_id": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/eximon4@4.93-13ubuntu1.12%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product": { "name": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_id": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-daemon-light@4.93-13ubuntu1.12%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product": { "name": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_id": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-daemon-light@4.93-13ubuntu1.12%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product": { "name": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_id": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-dev@4.93-13ubuntu1.12%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product": { "name": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_id": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-dev@4.93-13ubuntu1.12%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product": { "name": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_id": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-base@4.93-13ubuntu1.12%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product": { "name": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_id": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-base@4.93-13ubuntu1.12%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product": { "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_id": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-daemon-heavy@4.93-13ubuntu1.12%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product": { "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_id": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-daemon-heavy@4.93-13ubuntu1.12%2Btuxcare.els2?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "product": { "name": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "product_id": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-config@4.93-13ubuntu1.12%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "product": { "name": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "product_id": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4-config@4.93-13ubuntu1.12%2Btuxcare.els2?arch=all" } } }, { "category": "product_version", "name": "exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "product": { "name": "exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "product_id": "exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4@4.93-13ubuntu1.12%2Btuxcare.els2?arch=all" } } }, { "category": "product_version", "name": "exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "product": { "name": "exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "product_id": "exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/exim4@4.93-13ubuntu1.12%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64" }, "product_reference": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "eximon4-0:4.93-13ubuntu1.12.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12.amd64" }, "product_reference": "eximon4-0:4.93-13ubuntu1.12.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64" }, "product_reference": "eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64" }, "product_reference": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-daemon-light-0:4.93-13ubuntu1.12.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12.amd64" }, "product_reference": "exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64" }, "product_reference": "exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64" }, "product_reference": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-dev-0:4.93-13ubuntu1.12.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12.amd64" }, "product_reference": "exim4-dev-0:4.93-13ubuntu1.12.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64" }, "product_reference": "exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64" }, "product_reference": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-base-0:4.93-13ubuntu1.12.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12.amd64" }, "product_reference": "exim4-base-0:4.93-13ubuntu1.12.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64" }, "product_reference": "exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64" }, "product_reference": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64" }, "product_reference": "exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64 as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64" }, "product_reference": "exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all" }, "product_reference": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-config-0:4.93-13ubuntu1.12.all as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12.all" }, "product_reference": "exim4-config-0:4.93-13ubuntu1.12.all", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all" }, "product_reference": "exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all" }, "product_reference": "exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-0:4.93-13ubuntu1.12.all as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-0:4.93-13ubuntu1.12.all" }, "product_reference": "exim4-0:4.93-13ubuntu1.12.all", "relates_to_product_reference": "Ubuntu-20" }, { "category": "default_component_of", "full_product_name": { "name": "exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all as a component of Ubuntu 20.04", "product_id": "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all" }, "product_reference": "exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-20" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-51766", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "notes": [ { "category": "description", "text": "Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some other popular e-mail servers do not.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-51766" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/12/24/1", "url": "http://www.openwall.com/lists/oss-security/2023/12/24/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/12/25/1", "url": "http://www.openwall.com/lists/oss-security/2023/12/25/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/12/29/2", "url": "http://www.openwall.com/lists/oss-security/2023/12/29/2" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/01/01/1", "url": "http://www.openwall.com/lists/oss-security/2024/01/01/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/01/01/2", "url": "http://www.openwall.com/lists/oss-security/2024/01/01/2" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/01/01/3", "url": "http://www.openwall.com/lists/oss-security/2024/01/01/3" }, { "category": "external", "summary": "https://bugs.exim.org/show_bug.cgi?id=3063", "url": "https://bugs.exim.org/show_bug.cgi?id=3063" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255852" }, { "category": "external", "summary": "https://exim.org/static/doc/security/CVE-2023-51766.txt", "url": "https://exim.org/static/doc/security/CVE-2023-51766.txt" }, { "category": "external", "summary": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html", "url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html" }, { "category": "external", "summary": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca", "url": "https://git.exim.org/exim.git/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca" }, { "category": "external", "summary": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5", "url": "https://git.exim.org/exim.git/commit/cf1376206284f2a4f11e32d931d4aade34c206c5" }, { "category": "external", "summary": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766", "url": "https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2023-51766" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/" }, { "category": "external", "summary": "https://lwn.net/Articles/956533/", "url": "https://lwn.net/Articles/956533/" }, { "category": "external", "summary": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/", "url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2023/12/23/2", "url": "https://www.openwall.com/lists/oss-security/2023/12/23/2" }, { "category": "external", "summary": "https://www.youtube.com/watch?v=V8KPV96g1To", "url": "https://www.youtube.com/watch?v=V8KPV96g1To" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORN7OKEQPPBKUHYRQ6LR5PSNBQVDHAWB/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPDWHJPABVJCXDSNELSSVTIVAJU2MDUQ/" } ], "release_date": "2023-12-24T06:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-06-12T13:07:17.369690Z", "details": "CVE-2023-51766 only enables SMTP-level spoofing of the envelope MAIL FROM (SPF bypass) and has no impact on code execution, privilege escalation, data disclosure, or service availability on the Exim host. Exploitation requires the Exim server to be reachable for unauthenticated SMTP and to advertise PIPELINING/CHUNKING, plus a specific parsing mismatch with the downstream mail server; systems not operating Exim as a public MX or that limit submission are not exposed to this vector. Given these narrow preconditions and the protocol-only integrity impact, this can be safely deprioritized relative to vulnerabilities that directly compromise the host or mail store.", "product_ids": [ "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12.amd64" ] }, { "category": "no_fix_planned", "date": "2026-06-16T12:30:28.602381Z", "details": "This issue is only relevant to systems running Exim as an internet-facing SMTP receiver under a specific configuration: both PIPELINING and CHUNKING must be advertised, and exploitation depends on a relay-to-relay parser mismatch when DATA is used with malformed line endings—hosts that don’t receive mail from untrusted relays or don’t advertise one of these extensions aren’t exposed. The vulnerability does not enable code execution or data access; impact is confined to limited message spoofing (MAIL FROM/SPF bypass) with no confidentiality or availability effect. Given these narrow preconditions and the integrity-only impact, it is reasonable to deprioritize in centrally managed enterprise VM/server environments.", "product_ids": [ "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-base-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els1.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12+tuxcare.els2.all", "Ubuntu-20:exim4-config-0:4.93-13ubuntu1.12.all", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-heavy-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-daemon-light-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:exim4-dev-0:4.93-13ubuntu1.12.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els1.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12+tuxcare.els2.amd64", "Ubuntu-20:eximon4-0:4.93-13ubuntu1.12.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }