Insufficient Verification of Data Authenticity Affecting aiosmtpd package, versions [,1.4.5)
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-AIOSMTPD-6437828
- published 14 Mar 2024
- disclosed 13 Mar 2024
- credit Unknown
Introduced: 13 Mar 2024
CVE-2024-27305 Open this link in a new tabHow to fix?
Upgrade aiosmtpd to version 1.4.5 or higher.
Overview
aiosmtpd is an aiosmtpd - asyncio based SMTP server
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to the improper handling of inbound SMTP connections. An attacker can send spoofed emails with fake sender addresses, enabling advanced phishing attacks by exploiting differences in the interpretation of the SMTP protocol.
References
CVSS Scores
version 3.1