CVE Vulnerability

CVE-2020-35679

smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043 Patch Third Party Advisory
https://www.mail-archive.com/misc@opensmtpd.org/msg05188.html Release Notes Third Party Advisory
https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202105-12 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:opensmtpd:opensmtpd:6.8.0:-:*:*:*:*:*:*
cpe:2.3:a:opensmtpd:opensmtpd:*:*:*:*:*:*:*:*
cpe:2.3:a:opensmtpd:opensmtpd:6.8.0:patch1-rc1:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Information

Published : 2020-12-24 04:15

Updated : 2022-04-26 04:13

NVD link : CVE-2020-35679

Mitre link : CVE-2020-35679

Products Affected
No products.
CWE
CWE-401