Vulnerability Description
smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensmtpd | Opensmtpd | < 6.8.0 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://github.com/openbsd/src/commit/6c3220444ed06b5796dedfd53a0f4becd903c0d1PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixeThird Party Advisory
- https://security.gentoo.org/glsa/202105-12Third Party Advisory
- https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
- https://github.com/openbsd/src/commit/6c3220444ed06b5796dedfd53a0f4becd903c0d1PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixeThird Party Advisory
- https://security.gentoo.org/glsa/202105-12Third Party Advisory
- https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
FAQ
What is CVE-2020-35680?
CVE-2020-35680 is a vulnerability with a CVSS score of 7.5 (HIGH). smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of cli...
How severe is CVE-2020-35680?
CVE-2020-35680 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-35680?
Check the references section above for vendor advisories and patch information. Affected products include: Opensmtpd Opensmtpd, Fedoraproject Fedora.