Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Strict CRLF check in SMTP protocol #661

Closed
hafeoz opened this issue Jan 1, 2024 · 0 comments
Closed

Strict CRLF check in SMTP protocol #661

hafeoz opened this issue Jan 1, 2024 · 0 comments
Labels
bug Something isn't working. ready-for-release Feature is implemented and available for testing in dev branch. It will be included in the next rele

Comments

@hafeoz
Copy link

hafeoz commented Jan 1, 2024 •
edited
Loading

The go-smtp package has released a new version, where strict CRLF check is performed to mitigate an zero-day attack against SMTP known as SMTP Smuggling. I think Maddy should probably update the dependency and (probably) release a new version with the updated dependency.

  • maddy version: all?
@hafeoz hafeoz added the bug Something isn't working. label Jan 1, 2024
@McSinyx McSinyx mentioned this issue Jan 10, 2024
Closed
@foxcpp foxcpp closed this as completed in db0874c Jan 21, 2024
@foxcpp foxcpp reopened this Jan 21, 2024
@foxcpp foxcpp added the ready-for-release Feature is implemented and available for testing in dev branch. It will be included in the next rele label Jan 21, 2024
@hafeoz hafeoz closed this as completed Jan 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working. ready-for-release Feature is implemented and available for testing in dev branch. It will be included in the next rele
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bump go-smtp to fix SMTP smuggling
2 participants
@foxcpp @hafeoz