Proxmox Mail Gateway - Security Advisories

[ProxmoxSecurityAdvisory]

This is the list of security advisories since 2024-01-01 for the Proxmox Mail Gateway.

For details about scope, coverage and timeline see the General FAQ about Proxmox Security Announcements.

 

[ProxmoxSecurityAdvisory]

Subject: PSA-2024-00005-1: SMTP Smuggling​

Publication date: 2024-03-28

Packages: pmg-api, postfix

Details: Postfix was affected by an email spoofing attack that involves a composition of email services with specific differences in the way they handle line endings other than <CR><LF>. See references below for timeline, mitigations and details.

Fixed:
- pmg-api >= 8.0.10 (Proxmox Mail Gateway 8.x)
- pmg-api >= 7.3-11 (Proxmox Mail Gateway 7.x)

References:
- CVE-2023-51764
- https://www.postfix.org/smtp-smuggling.html
- https://forum.proxmox.com/threads/smtp-smuggling-mitigation.138576/

 

[ProxmoxSecurityAdvisory]

Subject: PSA-2024-00007-1: Shim bootloader remote code execution via http response​

Advisory date: 2024-06-28

Packages: shim-unsigned, shim-signed

Details: A remote code execution vulnerability was found in the secure boot Shim bootloader. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Fixed: shim-unsigned >= 15.8, shim-signed >= 1.40+pmx1+15.8 (Proxmox VE 8.x, Proxmox Backup Server 3.x, Proxmox Mail Gateway 8.x)

Bullseye-based Proxmox products do not ship a custom version of shim, refer to Debian's security tracker if manual secure boot is in use.

References: CVE-2023-40547, shim 15.8 additionally fixes CVE-2023-40546 and CVE-2023-40548 to CVE-2023-40551