Bug#1070190: sendmail-bin: CVE-2023-51765 SMTP smuggling with NUL followup

2024-05-09 Thread Bastien Roucariès
Le samedi 4 mai 2024, 12:40:25 UTC Andreas Beckmann a écrit : > On 04/05/2024 13.02, Andreas Beckmann wrote: > >> I have patched sendmail in order to enable O RejectNUL=True directive, > >> but I do not achieved the fact to enable it by default. > > >> Andreas could you get a glimpse at how to

Bug#1070190: sendmail-bin: CVE-2023-51765 SMTP smuggling with NUL followup

2024-05-04 Thread Andreas Beckmann
On 04/05/2024 13.02, Andreas Beckmann wrote: I have patched sendmail in order to enable O RejectNUL=True directive, but I do not achieved the fact to enable it by default. Andreas could you get a glimpse at how to render  RejectNUL a default ? Second attempt. Completely untested. This

Bug#1070190: sendmail-bin: CVE-2023-51765 SMTP smuggling with NUL followup

2024-05-04 Thread Andreas Beckmann
On 01/05/2024 16.14, Bastien Roucariès wrote: Dear Maintainer, unfortunately sendmail is orphaned ... CVE-2023-51765 is not fully fixed at least for forwarding bad mail. We must reject NUL including mail as a stop gap method. I have patched sendmail in order to enable O RejectNUL=True

Bug#1070190: sendmail-bin: CVE-2023-51765 SMTP smuggling with NUL followup

2024-05-01 Thread Bastien Roucariès
Package: sendmail-bin Severity: important Tags: security help Forwarded: https://marc.info/?l=oss-security=171447187004229=2 Dear Maintainer, CVE-2023-51765 is not fully fixed at least for forwarding bad mail. We must reject NUL including mail as a stop gap method. I have patched sendmail in