Vulnerability Description
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensmtpd | Opensmtpd | < 6.8.0 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixeThird Party Advisory
- https://security.gentoo.org/glsa/202105-12Third Party Advisory
- https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
- https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixeThird Party Advisory
- https://security.gentoo.org/glsa/202105-12Third Party Advisory
- https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
FAQ
What is CVE-2020-35679?
CVE-2020-35679 is a vulnerability with a CVSS score of 7.5 (HIGH). smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
How severe is CVE-2020-35679?
CVE-2020-35679 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-35679?
Check the references section above for vendor advisories and patch information. Affected products include: Opensmtpd Opensmtpd, Fedoraproject Fedora.