CVE-2023-26432
20.06.2023, 08:15
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| open-xchange | open-xchange_appsuite_backend | 𝑥 < 7.10.6 |
| open-xchange | open-xchange_appsuite_backend | 8.0.0 ≤ 𝑥 < 8.11.0 |
| open-xchange | open-xchange_appsuite_backend | 7.10.6 |
| open-xchange | open-xchange_appsuite_backend | 7.10.6:revision_39 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| ox_project | ox | 𝑥 ≤ 8.10 | CNA |
References