Read the docs
TI-2011-00345 Aliases CVE-2011-0411GHSA-2gf2-4wwm-4cm6

The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x…

Priority MEDIUM 47CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.

Summary

The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.

Why it matters now

EPSS 0.16334 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:a:postfix:postfix:2.4:*:*:*:*:*:*:*2.4VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.0:*:*:*:*:*:*:*2.4.0VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.1:*:*:*:*:*:*:*2.4.1VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.2:*:*:*:*:*:*:*2.4.2VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.3:*:*:*:*:*:*:*2.4.3VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.4:*:*:*:*:*:*:*2.4.4VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.5:*:*:*:*:*:*:*2.4.5VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.6:*:*:*:*:*:*:*2.4.6VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.7:*:*:*:*:*:*:*2.4.7VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.8:*:*:*:*:*:*:*2.4.8VulnerablePostfix
  • cpe:2.3:a:postfix:postfix:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.6:*:*:*:*:*:*:* Versions 2.4.6 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.7:*:*:*:*:*:*:* Versions 2.4.7 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.8:*:*:*:*:*:*:* Versions 2.4.8 Vulnerable ·Postfix
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:postfix:postfix:2.4.9:*:*:*:*:*:*:*2.4.9VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.10:*:*:*:*:*:*:*2.4.10VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.11:*:*:*:*:*:*:*2.4.11VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.12:*:*:*:*:*:*:*2.4.12VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.13:*:*:*:*:*:*:*2.4.13VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.14:*:*:*:*:*:*:*2.4.14VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.4.15:*:*:*:*:*:*:*2.4.15VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.0:*:*:*:*:*:*:*2.5.0VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.1:*:*:*:*:*:*:*2.5.1VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.2:*:*:*:*:*:*:*2.5.2VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.3:*:*:*:*:*:*:*2.5.3VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.4:*:*:*:*:*:*:*2.5.4VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.5:*:*:*:*:*:*:*2.5.5VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.6:*:*:*:*:*:*:*2.5.6VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.7:*:*:*:*:*:*:*2.5.7VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.8:*:*:*:*:*:*:*2.5.8VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.9:*:*:*:*:*:*:*2.5.9VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.10:*:*:*:*:*:*:*2.5.10VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.5.11:*:*:*:*:*:*:*2.5.11VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6:*:*:*:*:*:*:*2.6VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.0:*:*:*:*:*:*:*2.6.0VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.1:*:*:*:*:*:*:*2.6.1VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.2:*:*:*:*:*:*:*2.6.2VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.3:*:*:*:*:*:*:*2.6.3VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.4:*:*:*:*:*:*:*2.6.4VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.5:*:*:*:*:*:*:*2.6.5VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.6:*:*:*:*:*:*:*2.6.6VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.7:*:*:*:*:*:*:*2.6.7VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.6.8:*:*:*:*:*:*:*2.6.8VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.7.0:*:*:*:*:*:*:*2.7.0VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.7.1:*:*:*:*:*:*:*2.7.1VulnerablePostfix
cpe:2.3:a:postfix:postfix:2.7.2:*:*:*:*:*:*:*2.7.2VulnerablePostfix
  • cpe:2.3:a:postfix:postfix:2.4.9:*:*:*:*:*:*:* Versions 2.4.9 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.11:*:*:*:*:*:*:* Versions 2.4.11 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.12:*:*:*:*:*:*:* Versions 2.4.12 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.13:*:*:*:*:*:*:* Versions 2.4.13 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.14:*:*:*:*:*:*:* Versions 2.4.14 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.4.15:*:*:*:*:*:*:* Versions 2.4.15 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.6:*:*:*:*:*:*:* Versions 2.5.6 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.8:*:*:*:*:*:*:* Versions 2.5.8 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.9:*:*:*:*:*:*:* Versions 2.5.9 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.10:*:*:*:*:*:*:* Versions 2.5.10 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.5.11:*:*:*:*:*:*:* Versions 2.5.11 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.6:*:*:*:*:*:*:* Versions 2.6.6 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.7:*:*:*:*:*:*:* Versions 2.6.7 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.6.8:*:*:*:*:*:*:* Versions 2.6.8 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Postfix
  • cpe:2.3:a:postfix:postfix:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Postfix

Remediation

Red Hat 2 advisories

  • RHSA-2011:0423 Released 2011-04-06 · Red Hat rating Moderate
    postfix security update
    • Red Hat Enterprise Linux Desktop (v. 6) postfix-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux Desktop Optional (v. 6) postfix-2:2.6.6-2.1.el6_0, postfix-perl-scripts-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux HPC Node (v. 6) postfix-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) postfix-2:2.6.6-2.1.el6_0, postfix-perl-scripts-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux Server (v. 6) postfix-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux Server Optional (v. 6) postfix-2:2.6.6-2.1.el6_0, postfix-perl-scripts-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux Workstation (v. 6) postfix-2:2.6.6-2.1.el6_0
    • Red Hat Enterprise Linux Workstation Optional (v. 6) postfix-2:2.6.6-2.1.el6_0, postfix-perl-scripts-2:2.6.6-2.1.el6_0
  • RHSA-2011:0422 Released 2011-04-06 · Red Hat rating Moderate
    postfix security update
    • Red Hat Enterprise Linux (v. 5.6.z server) postfix-2:2.3.3-2.2.el5_6, postfix-2:2.3.3-2.2.el5_6.i386, postfix-2:2.3.3-2.2.el5_6.ia64 +5
    • Red Hat Enterprise Linux AS version 4 postfix-2:2.2.10-1.4.el4, postfix-2:2.2.10-1.4.el4.i386, postfix-2:2.2.10-1.4.el4.ia64 +5
    • Red Hat Enterprise Linux Desktop version 4 postfix-2:2.2.10-1.4.el4, postfix-2:2.2.10-1.4.el4.i386, postfix-pflogsumm-2:2.2.10-1.4.el4 +1
    • Red Hat Enterprise Linux ES version 4 postfix-2:2.2.10-1.4.el4, postfix-2:2.2.10-1.4.el4.i386, postfix-2:2.2.10-1.4.el4.ia64 +3
    • Red Hat Enterprise Linux WS version 4 postfix-2:2.2.10-1.4.el4, postfix-2:2.2.10-1.4.el4.i386, postfix-2:2.2.10-1.4.el4.ia64 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:0422
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:0422
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:0422
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:0422
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:0422
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0423
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2011:0423

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0411
  2. 2026-10-03 Alias added: GHSA-2gf2-4wwm-4cm6

References

Exploit 1

Advisory 10

Other 8

  • TI-2011-01499 The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and… CVSS 2.0MEDIUM 6.8
  • TI-2023-28393 Postfix through 3.8.5 allows SMTP smuggling unless configured with… CVSS 3.1MEDIUM 5.3
  • TI-2017-07491 Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2… CVSS 3.0HIGH 7.8
  • TI-2026-32009 Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a… CVSS 3.1HIGH 7.5
  • TI-2012-00748 Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5… CVSS 2.0MEDIUM 6.5
  • TI-2009-02800 The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package… CVSS 2.0MEDIUM 6.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences