#1083139 nullmailer: msg is rejected with "Bare carriage return (CR) not allowed" after CVE-2023-51765 fix

Package:
nullmailer
Source:
nullmailer
Description:
simple relay-only mail transport agent
Submitter:
Bjørn Mork
Date:
2024-10-02 13:45:01 UTC
Severity:
normal
Tags:
#1083139#5
Date:
2024-10-02 11:19:15 UTC
From:
To:
Dear Maintainer,

Some messages from nullmailer are rejected by my smart relay running Debian
sendmaili, after it was updated with
https://lists.debian.org/debian-lts-announce/2024/06/msg00004.html

The faiing messages are typically from cron jobs returning a single line
of text ending in a carriage return (\r).

The problem can be reproduced by running

 echo -e "To: root@example.com\n\nFoo\r"|nullmailer-inject

Which results in

 2024-10-02T11:09:08.179422+00:00 gustav nullmailer-send[453]: Starting delivery, 1 message(s) in queue.
 2024-10-02T11:09:08.179444+00:00 gustav nullmailer-send[453]: Starting delivery: host: dilbert.example.com protocol: smtp file: 1727867348.32924
 2024-10-02T11:09:08.179466+00:00 gustav nullmailer-send[453]: From: <bjorn@gustav.example.org> to: <root@example.com>
 2024-10-02T11:09:08.179489+00:00 gustav nullmailer-send[453]: Message-Id: <1727867348.172026.32923.nullmailer@gustav.example.org>
 2024-10-02T11:09:10.006453+00:00 gustav nullmailer-send[32925]: smtp: Failed: 421 4.5.0 Bare carriage return (CR) not allowed
 2024-10-02T11:09:10.007814+00:00 gustav nullmailer-send[453]: Sending failed: Temporary error in sending the message
 2024-10-02T11:09:10.007885+00:00 gustav nullmailer-send[453]: Delivery complete, 1 message(s) remain.

The issue is fixed by https://github.com/bruceg/nullmailer/pull/76


Bjørn