Medium severity5.4OSV Advisory· Published May 18, 2024· Updated Apr 15, 2026

CVE-2024-34083

Description

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
aiosmtpdPyPI	< 1.4.6	1.4.6

Affected products

Aio Libs/AiosmtpdOSV
Range: 1.0, 1.0a1, 1.0a2, …
ghsa-coords3 versions
pkg:pypi/aiosmtpd pkg:rpm/opensuse/python-aiosmtpd&distro=openSUSE%20Leap%2015.5 pkg:rpm/suse/python-aiosmtpd&distro=SUSE%20Package%20Hub%2015%20SP5
< 1.4.6+ 2 more
- (no CPE)range: < 1.4.6
- (no CPE)range: < 1.2.1-bp155.3.3.1
- (no CPE)range: < 1.2.1-bp155.3.3.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wgjv-9j3q-jhg8ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-34083ghsaADVISORY
github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfdanvdWEB
github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8nvdWEB
nostarttls.secvuln.infonvdWEB

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000