REDHAT-BUG-1303647: Medium severity Python Software Foundation smtplib vulnerability
A vulnerability in smtplib allowing MITM attacker to perform a startTLS stripping attack. smtplib does not seem to raise an exception when the remote end (smtp server) is capable of negotiating starttls but fails to respond with 220 (ok) to an explicit call of SMTP.starttls(). This may allow a malicious MITM to perform a startTLS stripping attack if the client code does not explicitly check the response code for startTLS.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using smtplib that connect to SMTP servers through a malicious man-in-the-middle and rely on SMTP.starttls() without explicitly checking its response code may be exposed.
What must an attacker be able to do to exploit it?
An attacker needs a man-in-the-middle position between the client and SMTP server, allowing them to interfere with the server's response to the explicit STARTTLS request.
How can applications reduce risk if they cannot update immediately?
Ensure client code explicitly checks the response code from SMTP.starttls() and treats a response other than 220 as a failure rather than continuing without TLS.