-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 13 May 2024 18:44:56 +0000 Source: sendmail Architecture: source Version: 8.15.2-22+deb11u1 Distribution: bullseye Urgency: medium Maintainer: Debian QA Group <packages@qa.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1059386 1070190 Changes: sendmail (8.15.2-22+deb11u1) bullseye; urgency=medium . * QA-upload * Fix CVE-2023-51765 (Closes: #1059386): sendmail allowed SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved with 'o' in srv_features. * Enable _FFR_REJECT_NUL_BYTE for rejecting mail that include NUL byte * By default enable rejecting mail that include NUL byte. set confREJECT_NUL to 'true' by default . User could disable by setting confREJECT_NUL to false. (Closes: #1070190). Close a variant of CVE-2023-51765 aka SMTP smuggling. Checksums-Sha1: e8387dc8f69767f775bf200bca982c84b0e3b35b 2583 sendmail_8.15.2-22+deb11u1.dsc 5801d4b06f4e38ef228a5954a44d17636eaa5a16 2207417 sendmail_8.15.2.orig.tar.gz c92f537870c0d7999fba9514d70dc72b1b15b5a4 237992 sendmail_8.15.2-22+deb11u1.debian.tar.xz 91544b74daf90cb88fd5be9e41d57dcfccb4e0be 10852 sendmail_8.15.2-22+deb11u1_amd64.buildinfo Checksums-Sha256: 01209292838448434150f88db19e6b99149cbedf152eb1730c586c01247eb689 2583 sendmail_8.15.2-22+deb11u1.dsc 24f94b5fd76705f15897a78932a5f2439a32b1a2fdc35769bb1a5f5d9b4db439 2207417 sendmail_8.15.2.orig.tar.gz 4a41780cc5257cd2544468b319ab8485f19db0a128516984b539df8b6191c168 237992 sendmail_8.15.2-22+deb11u1.debian.tar.xz fab45feef620621f9568c00a2704b73d8ef3618991c766151e9060f461bdb50e 10852 sendmail_8.15.2-22+deb11u1_amd64.buildinfo Files: bd1354eb43821c1ae25145cac1ad8576 2583 mail optional sendmail_8.15.2-22+deb11u1.dsc a824fa7dea4d3341efb6462ccd816f00 2207417 mail optional sendmail_8.15.2.orig.tar.gz 063725ac14b612541d3894f277cba34e 237992 mail optional sendmail_8.15.2-22+deb11u1.debian.tar.xz ece20853faa7b86f0068b921fc92b5cc 10852 mail optional sendmail_8.15.2-22+deb11u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmZuBQIRHHJvdWNhQGRl Ymlhbi5vcmcACgkQADoaLapBCF9LGg//RTfP04a0TRSgIgn8gcp5Q3hmqcVBMSBX SaqS0o9NHkJR0R5c/Hwldl/yXqrl/NgFneWXZSlflePU1oGS7oCUQi+jlsHRQIU6 ovNJEj3LZQvMxQtihJVnAN6sABv2jEWRquvmbk0Xb2UO1B3kdpP3pmsrgnlBhV1p odcDhbN0LVkUGoHiNhwwUxNkEREhAuVYHEaSzU6L0y2hHsfmzSZn+XP+p9zrPyot SiMuWwtACJEZwniSJ7zn+XKSUR8oQ4usIXTPxVD7YZV8sCRB6+V/QROHkRwTXFCk 6ecqhP2VXAK5hUU4Bu7w2Jcij4N2vRoVvoeP6w8UbSObziHKoDeuyyshQM3Vp3hL Y7+VAB0HGFs8fIAd6qyckoafJw1HBrBrBAUO6/xcfQcfh8rcaNcJyhOnOcZxBQEe ofpaprutBGnlbSijlH1VAkPEFlmSYEvRHsGgDaoCs4rWKALCoVrvQM+SeTaF+vii SpkAdNDnyWcVz5IMIuAfVMRFA2REOdcuxbdfR0vvpeH2spCpIlnzEOK/tca3BsGN F2nk8kPb4QhJLd/TH2AhAX5ot84zZFC5SXwD/54zF5IPrHarCKrgOqB1gcKriZQm aqNIC3iMwqp9t2/qyVyMbG+X0qkP1keNCwv4G6oHL3gxdfX2SueOUe96DRa+CK39 OfxYtVPc7uE= =yh31 -----END PGP SIGNATURE-----
