PT-2021-3909 · Libspf2+4 · Libspf2+4

Dhananjay Arunesh · Published 2021-08-11 · Updated 2024-11-26 · CVE-2021-20314

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libspf2 versions prior to 1.2.11

Description The issue is related to a stack buffer overflow in libspf2 when processing certain SPF macros, which can lead to Denial of service and potentially code execution via maliciously crafted SPF explanation messages. This can be exploited by a remote attacker to execute arbitrary code by overflowing the stack buffer.

Recommendations For versions prior to 1.2.11, update to version 1.2.11 or later to resolve the issue. As a temporary workaround, consider restricting the processing of SPF macros to minimize the risk of exploitation. Avoid using libspf2 with untrusted input until the issue is resolved.

Fix

DoS

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

ALT-PU-2021-3046

ALT-PU-2022-2548

ALT-PU-2024-1215

BDU:2021-04420

CVE-2021-20314

DLA-2739-1

DSA-4955-1

MGASA-2021-0414

MGASA-2021-0454

OPENSUSE-SU-2021:1187-1

OPENSUSE-SU-2021_1187-1

OPENSUSE-SU-2024:10995-1

ROSA-SA-2024-2528

USN-6584-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Libspf2

References · 41

• https://ubuntu.com/security/notices/USN-6584-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-20314 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMSFT2NJDZ7PATRZSQPAOGSE7JD6ELOB · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33913 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1187-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6584-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CMSFT2NJDZ7PATRZSQPAOGSE7JD6ELOB · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20314 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1993070 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10995-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJRHPE5OSCPTNA3ZZ4ORDHT4JQH3Y4 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0454.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20314 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0414 · Vendor Advisory