oss-sec mailing list archives

Re: New SMTP smuggling attack


From: Claus Assmann <ml+oss () esmtp org>
Date: Thu, 21 Dec 2023 14:46:56 +0000

Just for completeness:
sendmail 8.18.0.2 has options to handle this too, e.g.,
        Accept only CR LF . CR LF as end of an SMTP message as
                required by the RFCs when the new srv_features
                option 'o' is used.

And for those who read the source code there's also an FFR:
        /* enable checking for "bare LF" in message */
        "_FFR_BARE_LF",


Current thread: