CVE-2016-0772

What it actually does

smtplib fails to raise an error or abort when the StartTLS command is rejected or stripped, allowing the subsequent SMTP session to continue over plaintext instead of TLS.

Why it matters to the business

Organizations using Python scripts to send email over untrusted networks risk disclosure or tampering of message contents and credentials because encryption can be silently disabled by an attacker positioned on the network path.

How an attack unfolds

An attacker on the path between a Python client and an SMTP server intercepts traffic, drops or responds negatively to the StartTLS command, and lets the client proceed with AUTH and mail transmission in cleartext; because no exception is raised the application continues as if TLS succeeded.

How to fix it

Upgrade CPython to 2.7.12 or later, 3.4.5 or later, or 3.5.2 or later; after upgrade, verify that smtplib.starttls() raises SMTPResponseException or aborts on failure and consider enforcing TLS with context.check_hostname and verify_mode.

How to confirm the fix worked

Run a test SMTP connection against a server that rejects StartTLS and confirm an exception is raised; scan source for calls to starttls() without subsequent exception handling; review installed Python version against the fixed releases listed above.

Typical attack path

1. Position as network MITM between Python SMTP client and mail server
2. Block or forge failure response to client's StartTLS command
3. Allow subsequent AUTH, MAIL FROM, RCPT TO, and DATA commands to proceed unencrypted
4. Capture or modify message content and any credentials sent in plaintext

How to detect it

Search application and mail-server logs for SMTP sessions that begin without a 220 STARTTLS-capable banner or that proceed directly to AUTH after a failed or absent StartTLS exchange; inspect network captures for plaintext SMTP traffic from Python processes on ports 25/587/465.

What your security team should do

• Immediately inventory all Python 2.7 < 2.7.12, 3.4 < 3.4.5, and 3.5 < 3.5.2 deployments that use smtplib
• Prioritize patching internet-facing or cloud-hosted Python email clients first
• Add runtime checks or wrapper code that treats StartTLS failure as fatal until upgrades complete
• Monitor EPSS and exploit availability; treat as high priority despite age because working exploits exist