SUSE-SU-2024:0743-1: Security update for sendmail
This update for sendmail fixes the following issues: CVE-2023-51765: Fixed new SMTP smuggling attack. (bsc#1218351)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libmilter-docto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/sendmail-starttlsto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/sendmail-debuginfoto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/sendmailto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/rmail-debuginfoto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/sendmail-develto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/sendmail-debugsourceto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade
suse/rmailto a version that resolves this vulnerability.Fixed in 8.15.2-150000.8.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2024-743=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-743=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-743=1
Event History
Frequently Asked Questions
Which systems are covered by this update?
The advisory applies to sendmail-related packages on SUSE openSUSE Leap 15.5, including sendmail-starttls, rmail, sendmail-debuginfo, sendmail-debugsource, rmail-debuginfo, and libmilter-doc. The listed architectures are aarch64, ppc64le, s390x, and x86_64, with a noarch package also listed.
What security issue does the update address?
It fixes CVE-2023-51765, described by SUSE as a new SMTP smuggling attack. The advisory does not provide exploit prerequisites, affected configuration details, or temporary mitigations.