{"id":"GHSA-wgjv-9j3q-jhg8","summary":"aiosmtpd STARTTLS unencrypted commands injection","details":"### Summary\nServers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack.\n\n### References\n* [NO STARTTLS: Similar vulnerabilities discovered by previous researchers.](https://nostarttls.secvuln.info/)","aliases":["CVE-2024-34083","PYSEC-2026-1111"],"modified":"2026-07-07T17:56:38.335961580Z","published":"2024-05-20T14:59:07Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-05-20T14:59:07Z","nvd_published_at":"2024-05-18T19:15:49Z","cwe_ids":["CWE-349"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34083"},{"type":"WEB","url":"https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiosmtpd"},{"type":"WEB","url":"https://nostarttls.secvuln.info"}],"affected":[{"package":{"name":"aiosmtpd","ecosystem":"PyPI","purl":"pkg:pypi/aiosmtpd"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6"}]}],"versions":["1.0","1.0a1","1.0a2","1.0a3","1.0a4","1.0a5","1.0b1","1.0rc1","1.1","1.2","1.2.2","1.2.4","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.4.3rc1","1.4.3rc2","1.4.4","1.4.4.post1","1.4.4.post2","1.4.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-wgjv-9j3q-jhg8/GHSA-wgjv-9j3q-jhg8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}