GHSA-wgjv-9j3q-jhg8

aiosmtpd STARTTLS unencrypted commands injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-34083

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	aiosmtpd	< 1.4.6	1.4.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack. ### References * [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)

References

External links from the advisory. They lead to third-party sites.

https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8 web
https://nvd.nist.gov/vuln/detail/CVE-2024-34083 advisory
https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda web
https://github.com/aio-libs/aiosmtpd package
https://nostarttls.secvuln.info web