Thank you for your contribution to Debian. Mapping bullseye to oldstable. Mapping oldstable to oldstable-proposed-updates.
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 13 May 2024 18:44:56 +0000
Source: sendmail
Architecture: source
Version: 8.15.2-22+deb11u1
Distribution: bullseye
Urgency: medium
Maintainer: Debian QA Group <packa...@qa.debian.org>
Changed-By: Bastien Roucariès <ro...@debian.org>
Closes: 1059386 1070190
Changes:
sendmail (8.15.2-22+deb11u1) bullseye; urgency=medium
.
* QA-upload
* Fix CVE-2023-51765 (Closes: #1059386):
sendmail allowed SMTP smuggling in certain configurations.
Remote attackers can use a published exploitation
technique to inject e-mail messages with a spoofed
MAIL FROM address, allowing bypass of an SPF protection
mechanism. This occurs because sendmail supports
<LF>.<CR><LF> but some other popular e-mail servers
do not. This is resolved with 'o' in srv_features.
* Enable _FFR_REJECT_NUL_BYTE for rejecting mail that
include NUL byte
* By default enable rejecting mail that include NUL byte.
set confREJECT_NUL to 'true' by default .
User could disable by setting confREJECT_NUL to false.
(Closes: #1070190). Close a variant of CVE-2023-51765
aka SMTP smuggling.
Checksums-Sha1:
e8387dc8f69767f775bf200bca982c84b0e3b35b 2583 sendmail_8.15.2-22+deb11u1.dsc
5801d4b06f4e38ef228a5954a44d17636eaa5a16 2207417 sendmail_8.15.2.orig.tar.gz
c92f537870c0d7999fba9514d70dc72b1b15b5a4 237992
sendmail_8.15.2-22+deb11u1.debian.tar.xz
91544b74daf90cb88fd5be9e41d57dcfccb4e0be 10852
sendmail_8.15.2-22+deb11u1_amd64.buildinfo
Checksums-Sha256:
01209292838448434150f88db19e6b99149cbedf152eb1730c586c01247eb689 2583
sendmail_8.15.2-22+deb11u1.dsc
24f94b5fd76705f15897a78932a5f2439a32b1a2fdc35769bb1a5f5d9b4db439 2207417
sendmail_8.15.2.orig.tar.gz
4a41780cc5257cd2544468b319ab8485f19db0a128516984b539df8b6191c168 237992
sendmail_8.15.2-22+deb11u1.debian.tar.xz
fab45feef620621f9568c00a2704b73d8ef3618991c766151e9060f461bdb50e 10852
sendmail_8.15.2-22+deb11u1_amd64.buildinfo
Files:
bd1354eb43821c1ae25145cac1ad8576 2583 mail optional
sendmail_8.15.2-22+deb11u1.dsc
a824fa7dea4d3341efb6462ccd816f00 2207417 mail optional
sendmail_8.15.2.orig.tar.gz
063725ac14b612541d3894f277cba34e 237992 mail optional
sendmail_8.15.2-22+deb11u1.debian.tar.xz
ece20853faa7b86f0068b921fc92b5cc 10852 mail optional
sendmail_8.15.2-22+deb11u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmZuBQIRHHJvdWNhQGRl
Ymlhbi5vcmcACgkQADoaLapBCF9LGg//RTfP04a0TRSgIgn8gcp5Q3hmqcVBMSBX
SaqS0o9NHkJR0R5c/Hwldl/yXqrl/NgFneWXZSlflePU1oGS7oCUQi+jlsHRQIU6
ovNJEj3LZQvMxQtihJVnAN6sABv2jEWRquvmbk0Xb2UO1B3kdpP3pmsrgnlBhV1p
odcDhbN0LVkUGoHiNhwwUxNkEREhAuVYHEaSzU6L0y2hHsfmzSZn+XP+p9zrPyot
SiMuWwtACJEZwniSJ7zn+XKSUR8oQ4usIXTPxVD7YZV8sCRB6+V/QROHkRwTXFCk
6ecqhP2VXAK5hUU4Bu7w2Jcij4N2vRoVvoeP6w8UbSObziHKoDeuyyshQM3Vp3hL
Y7+VAB0HGFs8fIAd6qyckoafJw1HBrBrBAUO6/xcfQcfh8rcaNcJyhOnOcZxBQEe
ofpaprutBGnlbSijlH1VAkPEFlmSYEvRHsGgDaoCs4rWKALCoVrvQM+SeTaF+vii
SpkAdNDnyWcVz5IMIuAfVMRFA2REOdcuxbdfR0vvpeH2spCpIlnzEOK/tca3BsGN
F2nk8kPb4QhJLd/TH2AhAX5ot84zZFC5SXwD/54zF5IPrHarCKrgOqB1gcKriZQm
aqNIC3iMwqp9t2/qyVyMbG+X0qkP1keNCwv4G6oHL3gxdfX2SueOUe96DRa+CK39
OfxYtVPc7uE=
=yh31
-----END PGP SIGNATURE-----
pgpFyWCn_xaHc.pgp
Description: PGP signature
