CVE-2023-52354: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-52354 affects chasquid, an SMTP server, in versions before 1.13. The vulnerability was discovered and disclosed on December 24, 2023, when it was patched in version 1.13. The issue affects the email server's handling of line terminations in SMTP communications (Vendor Advisory).

The vulnerability stems from chasquid's acceptance of LF-terminated lines in SMTP communications, which violates RFC5322 and RFC5321 specifications stating that CRLF is the only valid newline terminator in SMTP. This implementation flaw has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating a high-severity issue with network access vector and no required privileges or user interaction (NVD).

The vulnerability enables SMTP smuggling attacks, which could allow attackers to inject or manipulate email messages. This could potentially lead to email spoofing and bypass of security mechanisms like SPF (Sender Policy Framework) protections (Vendor Advisory).

The vulnerability has been fixed in chasquid version 1.13 and later. The fix implements strict CRLF enforcement in DATA contents, and when an invalid newline terminator is found in an incoming message, the connection is now aborted immediately. Additionally, the MTA courier now uses CRLF-terminated lines instead of LF-terminated lines (Vendor Advisory).