PT-2023-22230 · Unknown+2 · Opensmtpd Portable+2

Published 2023-04-04 · Updated 2025-11-04 · CVE-2023-29323

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions prior to 7.1 errata 024 OpenBSD versions prior to 7.2 errata 020 OpenSMTPD Portable versions prior to 7.0.0-portable commit f748277

Description The issue can cause ascii load sockaddr in smtpd to abort upon a connection from a local, scoped IPv6 address.

Recommendations For OpenBSD versions prior to 7.1 errata 024, apply errata 024 to resolve the issue. For OpenBSD versions prior to 7.2 errata 020, apply errata 020 to resolve the issue. For OpenSMTPD Portable versions prior to 7.0.0-portable commit f748277, update to a version that includes commit f748277 or later to resolve the issue.

Fix

Related Identifiers

CVE-2023-29323

ROSA-SA-2023-2210

Affected Products

Debian

Openbsd

Opensmtpd Portable

References · 25

• https://github.com/openbsd/src/commit/f748277ed1fc7065ae8998d61ed78b9ab1e55fae · Patch
• https://github.com/OpenSMTPD/OpenSMTPD/commit/41d0eae481f538956b1f1fbadfb535043454061f · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29323 · Security Note
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/020_smtpd.patch.sig · Patch
• https://security-tracker.debian.org/tracker/source-package/opensmtpd · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-29323 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZBNQBHCM6PIOUR6I5GEQS35XYT2NX6T · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29323 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29323 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-29323 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29323 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-29323 · Vendor Advisory
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.1/common/024_smtpd.patch.sig · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GZBNQBHCM6PIOUR6I5GEQS35XYT2NX6T · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29323 · Vendor Advisory