PT-2020-17389 · Openbsd · Opensmtpd

Published 2020-12-24 · Updated 2022-04-26 · CVE-2020-35679

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSMTPD versions prior to 6.8.0p1

Description The issue is related to a memory leak in OpenSMTPD. It is caused by a lack of a certain regfree in the smtpd/table.c file, which might allow attackers to trigger a significant memory leak via messages to an instance that performs many regex lookups.

Recommendations For OpenSMTPD versions prior to 6.8.0p1, update to version 6.8.0p1 or later to resolve the issue. As a temporary workaround, consider restricting the number of regex lookups performed by the instance to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2020-35679

Affected Products

Opensmtpd

References · 19

• https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043 · Patch
• https://osv.dev/vulnerability/CVE-2020-35679 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35679 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35679 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35679 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35679 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-35679 · Vendor Advisory
• https://security.gentoo.org/glsa/202105-12 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35679 · Security Note
• https://ubuntu.com/security/CVE-2020-35679 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J · Vendor Advisory
• https://t.me/cvenotify/8031 · Telegram Post
• https://mail-archive.com/[e-mail]/msg05188.html · Note
• https://mail-archive.com/misc%40opensmtpd.org/msg05188.html · Note