VulnerabilityModified
CVE-2020-35679
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
HIGH 7.5EPSS 2.83%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.83% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-401
- Affected
- opensmtpd/opensmtpd · fedoraproject/fedora
- Source
- cve@mitre.org
References
- https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/
- https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/Third Party Advisory
- https://security.gentoo.org/glsa/202105-12Third Party Advisory
- https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
- https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LKTFBQCHGMVPR4IZWHQIYAPM5J3LN3J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYAYXRV2DM5K4RU7RHCDZSA2UF6VCTRC/
- https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github/Third Party Advisory
- https://security.gentoo.org/glsa/202105-12Third Party Advisory
- https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.