CRLF is obsolete and should be abolished

Re:CRLF is obsolete and should be abolished by chasil on Sunday October 13, 2024 @04:18PM (#41831210)

FYI, Sendmail accepts LF without CR, but Exchange doesn't.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by 9dev on Sunday October 13, 2024 @05:36PM (#41831846)

…how very in character for each of them!

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by isThereClarity on Monday October 14, 2024 @04:43AM (#41835526)

sendmail 8.18.1 includes patches to correct this behaviour (and options to turn it back on) due to its role in SMTP smuggling, CVE-2023-51765. See https://ftp.sendmail.org/RELEASE_NOTES

  sendmail is now stricter in following the RFCs and rejects
  some invalid input with respect to line endings
  and pipelining:
  ...snip...
  - Accept only CRLF . CRLF as end of an SMTP message
    as required by the RFCs, which can disabled by the
    new srv_features option 'O'.
  - Do not accept a CR or LF except in the combination
    CRLF (as required by the RFCs).  These checks can
    be disabled by the new srv_features options
   'U' and 'G', respectively.  In this case it is
   suggested to use 'u2' and 'g2' instead so the server
   replaces offending bare CR or bare LF with a space.
   It is recommended to only turn these protections off
   for trusted networks due to the potential for abuse.

[ Parent | on HN ]