CVE-2020-35679
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
El archivo smtpd/table.c en OpenSMTPD versiones anteriores a 6.8.0p1, carece de determinado regfree, lo que podría permitir a atacantes activar un filtrado de memoria "very significant" por medio de mensajes hacia una instancia que lleva a cabo muchas búsquedas de expresiones regulares
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-12-24 CVE Reserved
- 2020-12-24 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://poolp.org/posts/2020-12-24/december-2020-opensmtpd-6.8.0p1-released-fixed-several-bugs-proposed-several-diffs-book-is-on-github | Third Party Advisory | |
| https://www.mail-archive.com/misc%40opensmtpd.org/msg05188.html | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910043 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Opensmtpd Search vendor "Opensmtpd" | Opensmtpd Search vendor "Opensmtpd" for product "Opensmtpd" | < 6.8.0 Search vendor "Opensmtpd" for product "Opensmtpd" and version " < 6.8.0" | - |
Affected
| ||||||
| Opensmtpd Search vendor "Opensmtpd" | Opensmtpd Search vendor "Opensmtpd" for product "Opensmtpd" | 6.8.0 Search vendor "Opensmtpd" for product "Opensmtpd" and version "6.8.0" | - |
Affected
| ||||||
| Opensmtpd Search vendor "Opensmtpd" | Opensmtpd Search vendor "Opensmtpd" for product "Opensmtpd" | 6.8.0 Search vendor "Opensmtpd" for product "Opensmtpd" and version "6.8.0" | patch1-rc1 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||